International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver contains hardcoded credentials for the account.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Mar 4, 2026 · NIST NVD

   Detected

   International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver contains hardcoded credentials for the account. A remote unauthenticated attacker can use these trivial, undocumented credentials to access the system via SSH. While initially dropped into a restricted shell, the attacker can trivially break out to achieve standard shell functionality.

2. Jun 17, 2026 · NIST NVD

   Updated

   International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver contains hardcoded credentials for the account. A remote unauthenticated attacker can use these trivial, undocumented credentials to access the system via SSH. While initially dropped into a restricted shell, the attacker can trivially break out to achieve standard shell functionality.

Affected

• cpe datacast/sfx2100 firmwareversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-28776

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-28776

  International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver contains hardcoded credentials for the account. A remote unauthenticated attacker can use these trivial, undocumented credentials to access the system via SSH. While initially dropped int

  nvd.nist.gov

References

• Exploit · abdulmhsblog.com