Description

International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver contains undocumented, hardcoded/insecure credentials for the `xd` user account. A remote unauthenticated attacker can log in via FTP using these credentials. Because the `xd` user has write permissions to their home directory where root-executed binaries and symlinks (such as those invoked by `xdstartstop`) are stored, the attacker can overwrite these files or manipulate symlinks to achieve arbitrary code execution as the root user.

INFO

Published Date :

2026-03-04T07:49:10.824Z

Last Modified :

2026-03-05T05:58:40.991Z

Source :

Gridware
AFFECTED PRODUCTS

The following products are affected by CVE-2026-28778 vulnerability.

Vendors Products
Datacast
  • Sfx2100
  • Sfx2100 Firmware
International Datacasting Corporation (idc)
  • Idc Sfx2100 Superflex Satellite Receiver
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2026-28778.

URL Resource
https://www.abdulmhsblog.com/posts/sfx2100-vulns/ cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Attack Requirements
Privileges Required
User Interaction
VS Confidentiality
VS Integrity
VS Availability
SS Confidentiality
SS Integrity
SS Availability
Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact