An OS Command Injection vulnerability exists in the web-based Traceroute diagnostic utility of International Datacasting Corporation (IDC) SFX Series SuperFlex Satelli…

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Mar 4, 2026 · NIST NVD

   Detected

   An OS Command Injection vulnerability exists in the web-based Traceroute diagnostic utility of International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver Web Management Interface version 101. An authenticated attacker can inject arbitrary shell metacharacters (such as the pipe operator) into the flags parameter, leading to the execution of arbitrary operating system command

2. Jun 17, 2026 · NIST NVD

   Updated

   An OS Command Injection vulnerability exists in the web-based Traceroute diagnostic utility of International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver Web Management Interface version 101. An authenticated attacker can inject arbitrary shell metacharacters (such as the pipe operator) into the flags parameter, leading to the execution of arbitrary operating system command

Affected

• cpe datacast/sfx2100 firmwareversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-28774

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-28774

  An OS Command Injection vulnerability exists in the web-based Traceroute diagnostic utility of International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver Web Management Interface version 101. An authenticated attacker can inject arbitrary shell metacharact

  nvd.nist.gov

References

• Exploit · abdulmhsblog.com