TI-2026-22970 Aliases CVE-2026-28775 GHSA-rvxp-rc2j-v2h6

Unauthenticated RCE via SNMP Default Writable Community String

MEDIUM 51CWE-1188Published 2026-03-04 · Updated 2026-03-05

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

An unauthenticated Remote Code Execution (RCE) vulnerability exists in the SNMP service of International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver. The deployment insecurely provisions the `private` SNMP community string with read/write access by default. Because the SNMP agent runs as root, an unauthenticated remote attacker can utilize `NET-SNMP-EXTEND-MIB` directives, abusing the fact that the system runs a vulnerable version of net-snmp pre 5.8, to execute arbitrary operating system commands with root privileges.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01232 69th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
International Datacasting Corporation (IDC)	SFX2100 Series SuperFlex SatelliteReceiver	SFX2100	—	No fix listed	CNA

SFX2100 Series SuperFlex SatelliteReceiver VendorInternational Datacasting Corporation (IDC) Affected SFX2100 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:o:datacast:sfx2100_firmware:-:::::::*	not specified by NVD	Vulnerable	International Datacasting Corporation (IDC)
cpe:2.3:h:datacast:sfx2100:-:::::::*	not specified by NVD	Running on	International Datacasting Corporation (IDC)

cpe:2.3:o:datacast:sfx2100_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·International Datacasting Corporation (IDC)
cpe:2.3:h:datacast:sfx2100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·International Datacasting Corporation (IDC)

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-28775
2026-10-03 Alias added: GHSA-rvxp-rc2j-v2h6

References

Exploit 1

https://www.abdulmhsblog.com/posts/sfx2100-vulns/

TI-2026-23266 Incorrect Permission Assignment(777) on `monitor` Users Home Directory Containing SUID Root Binaries in IDC SFX2100 CVSS 4.0CRITICAL 9.2
TI-2026-23267 IDC SFX2100 Satellite Receiver bgpd/ospfd/ripd/zebra Config Credential Disclosure via World-Readable Files CVSS 4.0HIGH 8.6
TI-2026-23265 World-Writable, Root Owned/Run `/etc/udhcpc/default.script` in IDC SFX2100 Satellite Receiver Leads To Potential LPE CVSS 4.0HIGH 8.5
TI-2026-22969 Authenticated OS Command Injection via Traceroute Utility leads to Root RCE CVSS 4.0CRITICAL 9.3
TI-2026-22968 Authenticated OS Command Injection via Ping Utility Leading to RCE as Root CVSS 4.0CRITICAL 9.3
TI-2026-22972 Hardcoded and Insecure Credentials for "User" Local Account with SSH Access On IDC SFX2100 Satellite Receiver CVSS 4.0CRITICAL 9.2

See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences