SNMP
CVE-2026-28775
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft SNMP request with private community string
-
ExploitInvoke NET-SNMP-EXTEND-MIB directives
-
ImpactExecute arbitrary OS commands as root
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V13 - Configuration Secure default settings
|
| Exploitation Conditions | IDC SFX Series SuperFlex SatelliteReceiver with default SNMP configuration exposing writable 'private' community string and running vulnerable net-snmp version pre-5.8 with SNMP agent running as root. |
| Impact | CVSS 9.8. Satellite receivers used in broadcast infrastructure. |
| Exploit ScenarioDerived | Login with known credentials to control satellite receiver. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Hardcoded/insecure credentials in IDC SFX Series SuperFlex Satellite Receiver. Multiple accounts with known credentials enable complete device takeover.
Earlier versions of this analysis (1)
Hardcoded credentials in IDC satellite receiver.
RemediationAI
Apply firmware update. Change all default credentials.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-798/CWE-1188. Multiple hardcoded accounts in satellite broadcasting equipment.
Know when SNMP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
An unauthenticated Remote Code Execution (RCE) vulnerability exists in the SNMP service of International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver. The deployment insecurely provisions the private SNMP community string with read/write access by default. Because the SNMP agent runs as root, an unauthenticated remote attacker can utilize NET-SNMP-EXTEND-MIB directives, abusing the fact that the system runs a vulnerable version of net-snmp pre 5.8, to execute arbitrary operating system commands with root privileges.
Executive ViewAI
Organizations operating IDC SFX Series SuperFlex SatelliteReceiver systems face an immediate critical risk: unauthenticated attackers can remotely execute arbitrary code by exploiting a default SNMP configuration. With public exploits available and no vendor patch deployed, any exposed satellite receiver is a direct attack vector that could compromise satellite communications infrastructure and downstream dependent systems.
Disable SNMP service entirely if not operationally required; restrict SNMP access via firewall to authorized management networks only; implement network segmentation to isolate satellite receivers; change default 'private' SNMP community string to a complex value; use SNMPv3 with authentication/encryption if SNMP must remain enabled; deploy IDS/IPS rules to detect SNMP-based RCE attempts; enable detailed logging of all receiver access and SNMP queries for incident detection.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
Related Vulnerabilities in IDC SFX SuperFlex Satellite Receiver Web Interface Flaws
View all 12html5_snmp 1.11 has multiple SQL injection vulnerabilities allowing attackers to manipulate SNMP monitoring database que
SQL injection in LibreNMS 25.12.0 and below. PoC and patch available.
SQL injection in LibreNMS versions 25.12.0 and below allows authenticated users to extract sensitive database informatio
Managed Switch Port Mapping Tool 2.85.2 contains a denial of service vulnerability that allows attackers to crash the ap
html5_snmp 1.11 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scrip
Reflected cross-site scripting in LibreNMS versions 25.12.0 and earlier allows unauthenticated remote attackers to injec
Stored XSS in LibreNMS versions 26.1.1 and below allows authenticated administrators to inject malicious scripts through
Stored XSS in LibreNMS versions 26.1.1 and below allows authenticated administrators to inject malicious scripts through
Stored XSS in LibreNMS Alert Rules allows authenticated administrators to inject malicious scripts that execute when oth
Improper SNMP request parsing in Cisco Nexus 9000 Series switches running ACI mode allows authenticated remote attackers
Incorrect privilege assignment in Huawei openUBMC causes the SNMP pseudo-identity group (special_users, including the SN
Stored cross-site scripting in LibreNMS versions 24.10.0 through 26.1.1 allows authenticated users to inject malicious s
GitHub PoC
Exploit-DB