CVE-2026-28774
An OS Command Injection vulnerability exists in the web-based Traceroute diagnostic utility of International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver Web Management Interface version 101.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.43%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
An OS Command Injection vulnerability exists in the web-based Traceroute diagnostic utility of International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver Web Management Interface version 101. An authenticated attacker can inject arbitrary shell metacharacters (such as the pipe `|` operator) into the flags parameter, leading to the execution of arbitrary operating system commands with root privileges.
- CVSS 4.0
- 9.3 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 2.43% probability · 83th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-78
- Affected
- datacast/sfx2100 firmware
- Source
- b7efe717-a805-47cf-8e9a-921fca0ce0ce
References
- https://www.abdulmhsblog.com/posts/sfx2100-vulns/Exploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.