What is the CVSS score of CVE-2026-29128?

CVE-2026-29128 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of IoT are affected by CVE-2026-29128?

IDC SFX2100 Satellite Receiver firmware contains a critical vulnerability exposing routing daemon configurations to unauthorized access, potentially allowing attackers to intercept, manipulate, or…

Is there a public PoC exploit available for CVE-2026-29128?

Yes, a public proof-of-concept exploit is available for CVE-2026-29128. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-29128?

Within 24 hours: Identify and inventory all IDC SFX2100 devices in production and development environments; isolate affected devices from critical network segments pending remediation. Within 7 days: Implement compensating controls including file permission hardening (restrict daemon config files to root-only access), network segmentation, and enhanced monitoring for unauthorized configuration access attempts. Within 30 days: Contact IDC for vendor patch availability; develop and test patch deployment procedures; establish timeline for coordinated patching across all affected devices with minimal service disruption.

IoT CVE-2026-29128

CRITICAL

Insufficiently Protected Credentials (CWE-522)

2026-03-05 b7efe717-a805-47cf-8e9a-921fca0ce0ce

IoT BGP Privilege Escalation Information Disclosure Credential Stuffing Linux Sfx2100 Firmware

10.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

PoC Detected

Mar 09, 2026 - 18:36 vuln.today

Public exploit code

CVE Published

Mar 05, 2026 - 06:16 nvd

CRITICAL 10.0

DescriptionCVE.org

IDC SFX2100 Satellite Receiver firmware ships with multiple daemon configuration files for routing components (e.g., zebra, bgpd, ospfd, and ripd) that are owned by root but world-readable. The configuration files (e.g., zebra.conf, bgpd.conf, ospfd.conf, ripd.conf) contain hardcoded or otherwise insecure plaintext passwords (including “enable”/privileged-mode credentials). A remote actor is able to abuse the reuse/hardcoded nature of these credentials to further access other systems in the network, gain a foothold on the satellite receiver or potentially locally privilege escalate.