Multiple SUID Root Binaries in `xd` User Home Directory Leading to Potential Local Privilege Escalation
Priority LOW 38CWE-269Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- Privilege escalation
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-269.
Summary
A SUID root-owned binary in /home/xd/terminal/XDTerminal in International Data Casting (IDC) SFX2100 on Linux allows a local actor to potentially preform local privilege escalation depending on conditions of the system via execution of the affected SUID binary. This can be via PATH hijacking, symlink abuse or shared object hijacking.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00145 3rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| International Datacasting Corporation (IDC) | SFX2100 Satellite Receiver | SFX2100 and later | — | No fix listed | CNA |
- SFX2100 Satellite Receiver VendorInternational Datacasting Corporation (IDC) Affected SFX2100 and later Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:datacast:sfx2100_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | International Datacasting Corporation (IDC) |
| cpe:2.3:h:datacast:sfx2100:-:*:*:*:*:*:*:* | not specified by NVD | Running on | International Datacasting Corporation (IDC) |
- cpe:2.3:o:datacast:sfx2100_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·International Datacasting Corporation (IDC)
- cpe:2.3:h:datacast:sfx2100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·International Datacasting Corporation (IDC)
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-29123
- 2026-10-03 Alias added: GHSA-4753-7q6g-548g
References
More International Datacasting Corporation (IDC) Sfx2100 Firmware vulnerabilities
- TI-2026-23266 Incorrect Permission Assignment(777) on `monitor` Users Home Directory Containing SUID Root Binaries in IDC SFX2100 CVSS 4.0CRITICAL 9.2
- TI-2026-23267 IDC SFX2100 Satellite Receiver bgpd/ospfd/ripd/zebra Config Credential Disclosure via World-Readable Files CVSS 4.0HIGH 8.6
- TI-2026-23265 World-Writable, Root Owned/Run `/etc/udhcpc/default.script` in IDC SFX2100 Satellite Receiver Leads To Potential LPE CVSS 4.0HIGH 8.5
- TI-2026-22970 Unauthenticated RCE via SNMP Default Writable Community String CVSS 4.0CRITICAL 10.0
- TI-2026-22969 Authenticated OS Command Injection via Traceroute Utility leads to Root RCE CVSS 4.0CRITICAL 9.3
- TI-2026-22968 Authenticated OS Command Injection via Ping Utility Leading to RCE as Root CVSS 4.0CRITICAL 9.3
Sources
- CVE-2026-29123 · CVE Program
- CVE-2026-29123 · NVD
- FIRST EPSS
- GHSA-4753-7q6g-548g · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences