CVE-2026-28778
International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver contains undocumented, hardcoded/insecure credentials for the user account.
Published Mar 4, 2026 · updated Jun 17, 2026 · datacast sfx2100 firmware
International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver contains undocumented, hardcoded/insecure credentials for the user account. A remote unauthenticated attacker can log in via FTP using these credentials. Because the user has write permissions to their home directory where root-executed binaries and symlinks (such as those invoked by ) are stored, the attacker can overwrite these files or manipulate symlinks to achieve arbitrary code execution as the root user.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Mar 4, 2026 · NIST NVD
Detected
International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver contains undocumented, hardcoded/insecure credentials for the user account. A remote unauthenticated attacker can log in via FTP using these credentials. Because the user has write permissions to their home directory where root-executed binaries and symlinks (such as those invoked by ) are stored, the attacker can
Jun 17, 2026 · NIST NVD
Updated
International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver contains undocumented, hardcoded/insecure credentials for the user account. A remote unauthenticated attacker can log in via FTP using these credentials. Because the user has write permissions to their home directory where root-executed binaries and symlinks (such as those invoked by ) are stored, the attacker can
Affected
- cpe datacast/sfx2100 firmwareversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-28778
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-28778
International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver contains undocumented, hardcoded/insecure credentials for the user account. A remote unauthenticated attacker can log in via FTP using these credentials. Because the user has write permi
nvd.nist.gov