Skip to content
CVE PROGRAM SOURCE RECORD7.9 High

CVE-2026-28778

Hardcoded FTP Credentials and LPE(via Insecure Permissions) for `xd` Local Account on IDC SFX2100

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Gridware

Description

International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver contains undocumented, hardcoded/insecure credentials for the `xd` user account. A remote unauthenticated attacker can log in via FTP using these credentials. Because the `xd` user has write permissions to their home directory where root-executed binaries and symlinks (such as those invoked by `xdstartstop`) are stored, the attacker can overwrite these files or manipulate symlinks to achieve arbitrary code execution as the root user.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

International Datacasting Corporation (IDC) IDC SFX2100 SuperFlex Satellite Receiver

Default version status: unaffected

  • SFX2100affected

References