PT-2026-22881 · International Datacasting · Sfx Series Superflex Satellitereceiver

Abdul Mhanni · Publicado 2026-03-04 · Atualizado 2026-03-05 · CVE-2026-28778

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver (affected versions not specified)

Description The IDC SFX Series SuperFlex Satellite Receiver is affected by hardcoded, insecure credentials for the xd user account. A remote, unauthenticated attacker can use these credentials to log in via FTP. The xd user has write permissions to their home directory, which contains root-executed binaries and symlinks used by xdstartstop. This allows an attacker to overwrite files or manipulate symlinks to achieve arbitrary code execution as the root user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

LPE

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2026-28778

Produtos afetados

Sfx Series Superflex Satellitereceiver

Referências · 8

• 🔥 https://abdulmhsblog.com/posts/sfx2100-vulns · Exploit
• https://twitter.com/CVEarity/status/2029546383636828334 · Publicação no Twitter
• https://twitter.com/infoflowcloud/status/2029104889935065517 · Publicação no Twitter
• https://t.me/CVEtracker/46289 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2029104265395093629 · Publicação no Twitter
• https://twitter.com/cyberbivash/status/2029112802716090516 · Publicação no Twitter
• https://abdulmhsblog.com/posts/spfx-vulnrabilities · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-28778 · Nota de Segurança