PT-2026-22877 · International Datacasting+1 · Sfx Series Superflex Satellitereceiver+1

Abdul Mhanni · Published 2026-03-04 · Updated 2026-04-24 · CVE-2026-28775

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver versions prior to 5.8

Description An unauthenticated Remote Code Execution (RCE) issue exists in the SNMP service. The system insecurely configures the private SNMP community string with read/write access by default. Because the SNMP agent operates with root privileges, a remote attacker without authentication can leverage NET-SNMP-EXTEND-MIB directives to execute arbitrary operating system commands with root privileges. This is possible due to the system running a version of net-snmp prior to 5.8.

Recommendations Update the net-snmp library to version 5.8 or later. Change the default SNMP community string from private to a strong, unique value. Restrict access to the SNMP service to authorized networks and hosts. Disable the NET-SNMP-EXTEND-MIB if it is not required.

Exploit

Fix

RCE

Weakness Enumeration

CWE-1188

Related Identifiers

CVE-2026-28775

Affected Products

Sfx Series Superflex Satellitereceiver

Net-Snmp

References · 9

• 🔥 https://abdulmhsblog.com/posts/sfx2100-vulns · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-28775 · Security Note
• https://twitter.com/CVEnew/status/2029104267878113690 · Twitter Post
• https://t.me/CVEtracker/46286 · Telegram Post
• https://abdulmhsblog.com/posts/spfx-vulnrabilities · Note
• https://twitter.com/vuldb/status/2029286150918291956 · Twitter Post
• https://twitter.com/CVEarity/status/2029553865138573762 · Twitter Post
• https://twitter.com/TheRabbitPy/status/2047593373179969659 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2029159723929411652 · Twitter Post