PT-2026-22881 · International Datacasting · Sfx Series Superflex Satellitereceiver

Abdul Mhanni · Published 2026-03-04 · Updated 2026-03-05 · CVE-2026-28778

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver (affected versions not specified)

Description The IDC SFX Series SuperFlex Satellite Receiver is affected by hardcoded, insecure credentials for the xd user account. A remote, unauthenticated attacker can use these credentials to log in via FTP. The xd user has write permissions to their home directory, which contains root-executed binaries and symlinks used by xdstartstop. This allows an attacker to overwrite files or manipulate symlinks to achieve arbitrary code execution as the root user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

LPE

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2026-28778

Affected Products

Sfx Series Superflex Satellitereceiver

References · 8

• 🔥 https://abdulmhsblog.com/posts/sfx2100-vulns · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-28778 · Security Note
• https://twitter.com/CVEarity/status/2029546383636828334 · Twitter Post
• https://twitter.com/infoflowcloud/status/2029104889935065517 · Twitter Post
• https://t.me/CVEtracker/46289 · Telegram Post
• https://twitter.com/CVEnew/status/2029104265395093629 · Twitter Post
• https://twitter.com/cyberbivash/status/2029112802716090516 · Twitter Post
• https://abdulmhsblog.com/posts/spfx-vulnrabilities · Note