TI-2026-23259 Aliases CVE-2026-29120 GHSA-g8xm-r69x-48cj

Insecure, Hardcoded Root Password Stored in Anaconda Configuration File On IDC SFX2100 Satellite Receiver

MEDIUM 41CWE-798Published 2026-03-04 · Updated 2026-03-05

Key facts

Attack vector: Local
Privileges required: High
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · None
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-798.

Summary

The /root/anaconda-ks.cfg installation configuration file in International Datacasting Corporation (IDC) SFX Series(SFX2100) SuperFlex Satellite Receiver insecurely stores the hardcoded root password hash. The password itself is highly insecure and susceptible to offline dictionary attacks using the rockyou.txt wordlist. Because direct root SSH login is disabled, an attacker must first obtain low-privileged access to the system (e.g., via other vulnerabilities) to be able to log in as the root user. The password is hardcoded and so allows for an actor with local access on effected versions to escalate to root

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00162 5th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
International Datacasting Corporation (IDC)	IDC SFX2100 SuperFlex Satellite Receiver	SFX2100	—	No fix listed	CNA

IDC SFX2100 SuperFlex Satellite Receiver VendorInternational Datacasting Corporation (IDC) Affected SFX2100 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:o:datacast:sfx2100_firmware:-:::::::*	not specified by NVD	Vulnerable	International Datacasting Corporation (IDC)
cpe:2.3:h:datacast:sfx2100:-:::::::*	not specified by NVD	Running on	International Datacasting Corporation (IDC)

cpe:2.3:o:datacast:sfx2100_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·International Datacasting Corporation (IDC)
cpe:2.3:h:datacast:sfx2100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·International Datacasting Corporation (IDC)

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-29120
2026-10-03 Alias added: GHSA-g8xm-r69x-48cj

References

Exploit 1

https://www.abdulmhsblog.com/posts/sfx2100-vulns/

TI-2026-23266 Incorrect Permission Assignment(777) on `monitor` Users Home Directory Containing SUID Root Binaries in IDC SFX2100 CVSS 4.0CRITICAL 9.2
TI-2026-23267 IDC SFX2100 Satellite Receiver bgpd/ospfd/ripd/zebra Config Credential Disclosure via World-Readable Files CVSS 4.0HIGH 8.6
TI-2026-23265 World-Writable, Root Owned/Run `/etc/udhcpc/default.script` in IDC SFX2100 Satellite Receiver Leads To Potential LPE CVSS 4.0HIGH 8.5
TI-2026-22970 Unauthenticated RCE via SNMP Default Writable Community String CVSS 4.0CRITICAL 10.0
TI-2026-22969 Authenticated OS Command Injection via Traceroute Utility leads to Root RCE CVSS 4.0CRITICAL 9.3
TI-2026-22968 Authenticated OS Command Injection via Ping Utility Leading to RCE as Root CVSS 4.0CRITICAL 9.3

See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences