Paper/Archive/CVE-2026-28774

CVE-2026-28774

International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver Web Management Interface — Authenticated OS Command Injection via Traceroute Utility leads to Root RCE

EPSS 3%CVSS 9.3

critical.is priorityof 100

CVSS 9.3 (CNA)9.3 / 10 × 3027.9 Not in CISA KEV+300.0 EPSS percentile 86.3.863 × 2017.3 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

An OS Command Injection vulnerability exists in the web-based Traceroute diagnostic utility of International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver Web Management Interface version 101. An authenticated attacker can inject arbitrary shell metacharacters (such as the pipe `|` operator) into the flags parameter, leading to the execution of arbitrary operating system commands with root privileges.

Affected

ProductAffectedFixed inSource

SFX Series SuperFlex SatelliteReceiver Web Management Interface101–CNA

Scores by source

Gridware (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refabdulmhsblog.com/posts/sfx2100-vulns