PT-2026-22872 · International Datacasting · Sfx Series Superflex Satellitereceiver

Abdul Mhanni · Publicado 2026-03-04 · Atualizado 2026-03-05 · CVE-2026-28770

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web management Interface version 101

Description The application does not properly neutralize special elements within the /IDC Logging/checkifdone.cgi script, leading to a potential XML Injection issue. User input from the file parameter is reflected unsanitized into a CDATA block, potentially allowing an authenticated attacker to inject arbitrary XML elements and break out of tags. This could lead to reflected Cross-Site Scripting (XSS) and potentially other attacks like XML External Entity (XXE) injection.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Correção

Enumeração de Fraquezas

CWE-91

Identificadores relacionados

CVE-2026-28770

Produtos afetados

Sfx Series Superflex Satellitereceiver

Referências · 10

• 🔥 https://abdulmhsblog.com/posts/sfx2100-vulns · Exploit
• https://abdulmhsblog.com/posts/spfx-vulnrabilities · Nota
• https://twitter.com/VulmonFeeds/status/2029175082610831524 · Publicação no Twitter
• https://twitter.com/cyberbivash/status/2029112625779331292 · Publicação no Twitter
• https://t.me/CVEtracker/46281 · Publicação no Telegram
• https://twitter.com/CVEarity/status/2029554723960107321 · Publicação no Twitter
• https://t.me/cveNotify/154272 · Publicação no Telegram
• https://t.me/cveNotify/154079 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-28770 · Nota de Segurança
• https://twitter.com/CVEnew/status/2029096605706518725 · Publicação no Twitter