PT-2026-22872 · International Datacasting · Sfx Series Superflex Satellitereceiver

Abdul Mhanni · Published 2026-03-04 · Updated 2026-03-05 · CVE-2026-28770

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web management Interface version 101

Description The application does not properly neutralize special elements within the /IDC Logging/checkifdone.cgi script, leading to a potential XML Injection issue. User input from the file parameter is reflected unsanitized into a CDATA block, potentially allowing an authenticated attacker to inject arbitrary XML elements and break out of tags. This could lead to reflected Cross-Site Scripting (XSS) and potentially other attacks like XML External Entity (XXE) injection.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Fix

Weakness Enumeration

CWE-91

Related Identifiers

CVE-2026-28770

Affected Products

Sfx Series Superflex Satellitereceiver

References · 10

• 🔥 https://abdulmhsblog.com/posts/sfx2100-vulns · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-28770 · Security Note
• https://abdulmhsblog.com/posts/spfx-vulnrabilities · Note
• https://twitter.com/VulmonFeeds/status/2029175082610831524 · Twitter Post
• https://twitter.com/cyberbivash/status/2029112625779331292 · Twitter Post
• https://t.me/CVEtracker/46281 · Telegram Post
• https://twitter.com/CVEarity/status/2029554723960107321 · Twitter Post
• https://t.me/cveNotify/154272 · Telegram Post
• https://t.me/cveNotify/154079 · Telegram Post
• https://twitter.com/CVEnew/status/2029096605706518725 · Twitter Post