CVE-2026-28775
An unauthenticated Remote Code Execution (RCE) vulnerability exists in the SNMP service of International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver.
Published Mar 4, 2026 · updated Jun 17, 2026 · datacast sfx2100 firmware
An unauthenticated Remote Code Execution (RCE) vulnerability exists in the SNMP service of International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver. The deployment insecurely provisions the SNMP community string with read/write access by default. Because the SNMP agent runs as root, an unauthenticated remote attacker can utilize directives, abusing the fact that the system runs a vulnerable version of net-snmp pre 5.8, to execute arbitrary operating system commands with root privileges.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Mar 4, 2026 · NIST NVD
Detected
An unauthenticated Remote Code Execution (RCE) vulnerability exists in the SNMP service of International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver. The deployment insecurely provisions the SNMP community string with read/write access by default. Because the SNMP agent runs as root, an unauthenticated remote attacker can utilize directives, abusing the fact that the syste
Jun 17, 2026 · NIST NVD
Updated
An unauthenticated Remote Code Execution (RCE) vulnerability exists in the SNMP service of International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver. The deployment insecurely provisions the SNMP community string with read/write access by default. Because the SNMP agent runs as root, an unauthenticated remote attacker can utilize directives, abusing the fact that the syste
Affected
- cpe datacast/sfx2100 firmwareversion unspecified
Sources
- NIST NVDVulnerability recordCVE-2026-28775
An unauthenticated Remote Code Execution (RCE) vulnerability exists in the SNMP service of International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver. The deployment insecurely provisions the SNMP community string with read/write access by defaul
nvd.nist.gov