CVE-2026-28775
Last modified
CVE-2026-28775 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. An unauthenticated Remote Code Execution (RCE) vulnerability exists in the SNMP service of International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver. The deployment insecurely provisions the `private` SNMP community string with read/write access by default. EPSS estimates a 1.20% chance of exploitation in the next 30 days.
Description
An unauthenticated Remote Code Execution (RCE) vulnerability exists in the SNMP service of International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver. The deployment insecurely provisions the `private` SNMP community string with read/write access by default. Because the SNMP agent runs as root, an unauthenticated remote attacker can utilize `NET-SNMP-EXTEND-MIB` directives, abusing the fact that the system runs a vulnerable version of net-snmp pre 5.8, to execute arbitrary operating system commands with root privileges.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Datacast | Sfx2100 Firmware | All versions |
References
- https://www.abdulmhsblog.com/posts/sfx2100-vulns/Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-28775?
How severe is CVE-2026-28775?
How do I fix CVE-2026-28775?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-2877A vulnerability has been found in Tenda A18 15.13.07.13. Thi…8.8
- CVE-2026-28770Improper neutralization of special elements in the /IDC_Logg…8.8
- CVE-2026-28771A Reflected Cross-Site Scripting (XSS) vulnerability exists …6.1
- CVE-2026-28772A Reflected Cross-Site Scripting (XSS) vulnerability in the …6.1
- CVE-2026-28773The web-based Ping diagnostic utility (/IDC_Ping/main.cgi) i…8.8
- CVE-2026-28774An OS Command Injection vulnerability exists in the web-base…8.8
- CVE-2026-28776International Datacasting Corporation (IDC) SFX Series Super…9.8
- CVE-2026-28777International Datacasting Corporation (IDC) SFX2100 Satell…9.8
- CVE-2026-28778International Datacasting Corporation (IDC) SFX Series Super…9.8
- CVE-2026-28779Apache Airflow versions 3.1.0 through 3.1.7 session token (_…7.5
- CVE-2026-2878In Progress® Telerik® UI for AJAX, versions prior to 2026.1.…5.9
- CVE-2026-28780Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of…9.8
Are you affected by CVE-2026-28775?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST