PT-2026-23098 · Unknown · Idc Sfx2100

Abdul Mhanni · Published 2026-03-05 · Updated 2026-03-11 · CVE-2026-29121

Positive Technologies (AI Summary)

CVSS v4.0

8.3

High

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:P/RE:L/U:Amber

Name of the Vulnerable Software and Affected Versions IDC SFX2100 satellite receiver (affected versions not specified)

Description The /sbin/ip utility is installed with the setuid bit set on the IDC SFX2100 satellite receiver. This configuration allows any local user who can execute the binary to gain elevated privileges. A local actor can leverage the GTFObins resource to perform privileged file reads as the root user on the local file system, potentially leading to further privileged actions. The API endpoint /sbin/ip is involved in this issue. The vulnerable parameter is not specified.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2026-29121

Affected Products

Idc Sfx2100

References · 10

• 🔥 https://abdulmhsblog.com/posts/sfx2100-vulns · Exploit
• 🔥 https://gtfobins.org/gtfobins/ip · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-29121 · Security Note
• https://twitter.com/cyberbivash/status/2029366580258197865 · Twitter Post
• https://t.me/cveNotify/155146 · Telegram Post
• https://t.me/cveNotify/154248 · Telegram Post
• https://t.me/CVEtracker/46392 · Telegram Post
• https://twitter.com/CVEnew/status/2030755429295288725 · Twitter Post
• https://twitter.com/cyberbivash/status/2029366576885968963 · Twitter Post
• https://abdulmhsblog.com/posts/spfx-vulnrabilities · Note