TI-2026-22965 Aliases CVE-2026-28770 GHSA-5jcc-2j97-xpcf

XML injection In /IDC_Logging/checkifdone.cgi Endpoint On IDC SFX Web Management Interface Version 101

LOW 24CWE-91Published 2026-03-04 · Updated 2026-03-05

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: Low · Low · Low
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Improper neutralization of special elements in the /IDC_Logging/checkifdone.cgi script in International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web management Interface version 101 allows for XML Injection. The application reflects un-sanitized user input from the `file` parameter directly into a CDATA block, allowing an authenticated attacker to break out of the tags and inject arbitrary XML elements. An actor is confirmed to be able to turn this into an reflected XSS but further abuse such as XXE may be possible

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00417 36th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
International Datacasting Corporation (IDC)	SFX Series SuperFlex Satellite Receiver Web management interface	101	—	No fix listed	CNA

SFX Series SuperFlex Satellite Receiver Web management interface VendorInternational Datacasting Corporation (IDC) Affected 101 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:o:datacast:sfx2100_firmware:-:::::::*	not specified by NVD	Vulnerable	International Datacasting Corporation (IDC)
cpe:2.3:h:datacast:sfx2100:-:::::::*	not specified by NVD	Running on	International Datacasting Corporation (IDC)

cpe:2.3:o:datacast:sfx2100_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·International Datacasting Corporation (IDC)
cpe:2.3:h:datacast:sfx2100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·International Datacasting Corporation (IDC)

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-28770
2026-10-03 Alias added: GHSA-5jcc-2j97-xpcf

References

Exploit 1

https://www.abdulmhsblog.com/posts/sfx2100-vulns/

TI-2026-23266 Incorrect Permission Assignment(777) on `monitor` Users Home Directory Containing SUID Root Binaries in IDC SFX2100 CVSS 4.0CRITICAL 9.2
TI-2026-23267 IDC SFX2100 Satellite Receiver bgpd/ospfd/ripd/zebra Config Credential Disclosure via World-Readable Files CVSS 4.0HIGH 8.6
TI-2026-23265 World-Writable, Root Owned/Run `/etc/udhcpc/default.script` in IDC SFX2100 Satellite Receiver Leads To Potential LPE CVSS 4.0HIGH 8.5
TI-2026-22970 Unauthenticated RCE via SNMP Default Writable Community String CVSS 4.0CRITICAL 10.0
TI-2026-22969 Authenticated OS Command Injection via Traceroute Utility leads to Root RCE CVSS 4.0CRITICAL 9.3
TI-2026-22968 Authenticated OS Command Injection via Ping Utility Leading to RCE as Root CVSS 4.0CRITICAL 9.3

See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences