PT-2026-23122 · Idc · Sfx2100 Satellite Receiver

Abdul Mhanni · Publicado 2026-03-05 · Atualizado 2026-03-11 · CVE-2026-29126

Positive Technologies (AI Summary)

CVSS v4.0

8.5

Alta

Vetor base

AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:H/SI:H/SA:H/AU:N/R:U

Name of the Vulnerable Software and Affected Versions IDC SFX2100 Satellite Receiver (affected versions not specified)

Description A misconfiguration involving incorrect permission assignment of a world-writable file, specifically /etc/udhcpc/default.script, exists. This allows a local, unprivileged attacker to potentially execute arbitrary commands with root privileges. The issue stems from the modification of a root-owned, world-writable BusyBox udhcpc DHCP event script. This script is executed during DHCP lease events – obtaining, renewing, or losing a lease – leading to potential local privilege escalation and persistence.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

LPE

Incorrect Authorization

Incorrect Permission

Enumeração de Fraquezas

CWE-863

CWE-732

Identificadores relacionados

CVE-2026-29126

Produtos afetados

Sfx2100 Satellite Receiver

Referências · 7

• 🔥 https://abdulmhsblog.com/posts/sfx2100-vulns · Exploit
• https://abdulmhsblog.com/posts/spfx-vulnrabilities · Nota
• https://twitter.com/CVEnew/status/2030755420587827526 · Publicação no Twitter
• https://t.me/cveNotify/155151 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2029454120487113124 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-29126 · Nota de Segurança
• https://t.me/CVEtracker/46398 · Publicação no Telegram