CVE-2026-28769

A path traversal vulnerability exists in the /IDC_Logging/checkifdone.cgi script in International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web management portal version 101. An authenticated attacker can manipulate the `file` parameter to traverse directories and enumerate arbitrary files on the underlying filesystem. Due to the insecure perl file path handling function in use, a authenticated actor is able to preform directory traversal, with the backup endpoint confirming a file exists by indicating that a backup operation was successful or when using the path of a non existent file, the returned status is failed.

• CWE-22

• https://www.abdulmhsblog.com/posts/sfx2100-vulns/Exploit, Third Party Advisory

Published

Mar 4, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-2876A vulnerability was determined in Tenda A18 15.13.07.13. Thi…8.8
• CVE-2026-28760The installer of RATOC RAID Monitoring Manager for Windows s…8.4
• CVE-2026-28761Cross-site request forgery vulnerability exists in Musethequ…8.5
• CVE-2026-28764A heap-based buffer overflow vulnerability exists in the LXF…7.8
• CVE-2026-28766A specific endpoint exposes all user account information for…7.5
• CVE-2026-28767A specific administrative endpoint notifications is accessib…5.3
• CVE-2026-2877A vulnerability has been found in Tenda A18 15.13.07.13. Thi…8.8
• CVE-2026-28770Improper neutralization of special elements in the /IDC_Logg…8.8
• CVE-2026-28771A Reflected Cross-Site Scripting (XSS) vulnerability exists …6.1
• CVE-2026-28772A Reflected Cross-Site Scripting (XSS) vulnerability in the …6.1
• CVE-2026-28773The web-based Ping diagnostic utility (/IDC_Ping/main.cgi) i…8.8
• CVE-2026-28774An OS Command Injection vulnerability exists in the web-base…8.8