TI-2026-23266 Aliases CVE-2026-29127 GHSA-ghhf-ppff-f3pr

Incorrect Permission Assignment(777) on `monitor` Users Home Directory Containing SUID Root Binaries in IDC SFX2100

HIGH 75CWE-269Published 2026-03-05 · Updated 2026-03-05

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Privilege escalation, Security bypass
Confidentiality · integrity · availability: High · High · None
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-269 and CWE-863.

Summary

The IDC SFX2100 Satellite Receiver sets overly permissive file system permissions on the monitor user's home directory. The directory is configured with permissions 0777, granting read, write, and execute access to all local users on the system, which may cause local privilege escalation depending on conditions of the system due to the presence of highly privileged processes and binaries residing within the affected directory.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00186 8th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
International Datacasting Corporation (IDC)	SFX2100 Satellite Receiver	SFX2100 and later	—	No fix listed	CNA

SFX2100 Satellite Receiver VendorInternational Datacasting Corporation (IDC) Affected SFX2100 and later Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:o:datacast:sfx2100_firmware:-:::::::*	not specified by NVD	Vulnerable	International Datacasting Corporation (IDC)
cpe:2.3:h:datacast:sfx2100:-:::::::*	not specified by NVD	Running on	International Datacasting Corporation (IDC)

cpe:2.3:o:datacast:sfx2100_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·International Datacasting Corporation (IDC)
cpe:2.3:h:datacast:sfx2100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·International Datacasting Corporation (IDC)

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-29127
2026-10-03 Alias added: GHSA-ghhf-ppff-f3pr

References

Exploit 1

https://www.abdulmhsblog.com/posts/sfx2100-vulns/

TI-2026-23267 IDC SFX2100 Satellite Receiver bgpd/ospfd/ripd/zebra Config Credential Disclosure via World-Readable Files CVSS 4.0HIGH 8.6
TI-2026-23265 World-Writable, Root Owned/Run `/etc/udhcpc/default.script` in IDC SFX2100 Satellite Receiver Leads To Potential LPE CVSS 4.0HIGH 8.5
TI-2026-22970 Unauthenticated RCE via SNMP Default Writable Community String CVSS 4.0CRITICAL 10.0
TI-2026-22969 Authenticated OS Command Injection via Traceroute Utility leads to Root RCE CVSS 4.0CRITICAL 9.3
TI-2026-22968 Authenticated OS Command Injection via Ping Utility Leading to RCE as Root CVSS 4.0CRITICAL 9.3
TI-2026-22972 Hardcoded and Insecure Credentials for "User" Local Account with SSH Access On IDC SFX2100 Satellite Receiver CVSS 4.0CRITICAL 9.2

See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences