Sfx2100 Firmware CVE-2026-28773
HIGHCVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionNVD
The web-based Ping diagnostic utility (/IDC_Ping/main.cgi) in International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web Management Interface version 101 is vulnerable to OS Command Injection. The application insecurely parses the IPaddr parameter. An authenticated attacker can bypass server-side semicolon exclusion checks by using alternate shell metacharacters (such as the pipe | operator) to append and execute arbitrary shell commands with root privileges.
AnalysisAI
Authenticated attackers can execute arbitrary OS commands with root privileges on IDC SFX2100 satellite receivers through command injection in the web-based Ping utility, bypassing input filters by using alternate shell metacharacters like the pipe operator. Public exploit code exists for this vulnerability, and no patch is currently available. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Identify and inventory all IDC SFX Series SuperFlex Satellite Receiver devices running version 101 in your environment. Within 7 days: Implement network-level access controls to restrict access to the /IDC_Ping/main.cgi endpoint to authorized users only, disable the ping utility if not operationally required, and apply WAF rules to block malicious IPaddr parameter payloads containing shell metacharacters. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today