PT-2026-22883 · Idc · Idc Sfx Series(Sfx2100) Superflex Satellite Receiver

Abdul Mhanni · Published 2026-03-04 · Updated 2026-03-05 · CVE-2026-29120

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions IDC SFX Series(SFX2100) SuperFlex Satellite Receiver (affected versions not specified)

Description The /root/anaconda-ks.cfg installation configuration file insecurely stores a hardcoded root password hash. This password is highly susceptible to offline dictionary attacks, such as those using the rockyou.txt wordlist. An attacker requires initial low-privileged access to the system to exploit this issue and escalate to root privileges, as direct root SSH login is disabled. The API endpoint /root/anaconda-ks.cfg is involved in this issue. The vulnerable variable is the hardcoded root password hash within the configuration file.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

LPE

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2026-29120

Affected Products

Idc Sfx Series(Sfx2100) Superflex Satellite Receiver

References · 7

• 🔥 https://abdulmhsblog.com/posts/sfx2100-vulns · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-29120 · Security Note
• https://twitter.com/VulmonFeeds/status/2029149485385859454 · Twitter Post
• https://twitter.com/CVEarity/status/2029546912131727709 · Twitter Post
• https://t.me/CVEtracker/46291 · Telegram Post
• https://twitter.com/CVEnew/status/2029113725307724012 · Twitter Post
• https://abdulmhsblog.com/posts/spfx-vulnrabilities · Note