Back to overview

CVE-2026-28775

CRITICAL
10.0
CVSS 4.0
Description
An unauthenticated Remote Code Execution (RCE) vulnerability exists in the SNMP service of International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver. The deployment insecurely provisions the `private` SNMP community string with read/write access by default. Because the SNMP agent runs as root, an unauthenticated remote attacker can utilize `NET-SNMP-EXTEND-MIB` directives, abusing the fact that the system runs a vulnerable version of net-snmp pre 5.8, to execute arbitrary operating system commands with root privileges.

Metadata

CVE ID
CVE-2026-28775
State
PUBLISHED
Assigner
Gridware
Reserved
2026-03-03 09:59 UTC
Published
2026-03-04 07:24 UTC
Last updated
2026-03-05 05:59 UTC
Primary CWE
CWE-1188
CWE-1188: Insecure Default Initialization of Resource
Vendor / Product
International Datacasting Corporation (IDC) / SFX2100 Series SuperFlex SatelliteReceiver
Sources
cve.org  ·  NVD

Severity & Metrics

10.0 CRITICAL CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
SSVC — CISA Coordinator
Exploitation
none
Automatable
yes
Tech. Impact
total
Affected products (1)
VendorProductPlatformVersions
International Datacasting Corporation (IDC) SFX2100 Series SuperFlex SatelliteReceiver — SFX2100
Weakness (CWE)
CWESourceDescription
CWE-1188 cna CWE-1188: Insecure Default Initialization of Resource
CVSS scores (1)
ScoreSeverityVersionSourceVector
10.0 CRITICAL 4.0 cna CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
References (1)
Back to overview