Paper/Archive/CVE-2026-28773

CVE-2026-28773

International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver Web Management Interface — Authenticated OS Command Injection via Ping Utility Leading to RCE as Root

EPSS 2%CVSS 9.3

critical.is priorityof 100

CVSS 9.3 (CNA)9.3 / 10 × 3027.9 Not in CISA KEV+300.0 EPSS percentile 83.9.839 × 2016.8 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

The web-based Ping diagnostic utility (/IDC_Ping/main.cgi) in International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web Management Interface version 101 is vulnerable to OS Command Injection. The application insecurely parses the `IPaddr` parameter. An authenticated attacker can bypass server-side semicolon exclusion checks by using alternate shell metacharacters (such as the pipe `|` operator) to append and execute arbitrary shell commands with root privileges.

Affected

ProductAffectedFixed inSource

SFX Series SuperFlex SatelliteReceiver Web Management Interface101–CNA

Scores by source

Gridware (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refabdulmhsblog.com/posts/sfx2100-vulns