CVE-2026-28777

CRITICAL

International Datacasting Corporation SFX2100 Satellite Receiver - Use of Hard-coded Credentials

Title source: llm
STIX 2.1

Description

International Datacasting Corporation (IDC) SFX2100 Satellite Receiver, trivial password for the `user` (usr) account. A remote unauthenticated attacker can exploit this to gain unauthorized SSH access to the system, while intially dropped into a restricted shell, an attacker can trivially spawn a complete pty to gain an appropriately interactive shell.

References (2)

Core 2

Scores

CVSS v3 9.8
EPSS 0.0049
EPSS Percentile 37.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-798
Status published
Products (1)
datacast/sfx2100_firmware
Published Mar 04, 2026
Tracked Since Mar 04, 2026