CVE-2026-28771 — Reflected XSS In /index.cgi Endpoint On IDC Satellite Receiver Web Management Interface Version 101

CVE-2026-28771

Reflected XSS In /index.cgi Endpoint On IDC Satellite Receiver Web Management Interface Version 101 PUBLISHED

Description (CNA)

A Reflected Cross-Site Scripting (XSS) vulnerability exists in the /index.cgi endpoint of International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web Management Interface version 101. The application fails to adequately sanitize user-supplied input provided via the `cat` parameter before reflecting it in the HTTP response, allowing a remote attacker to execute arbitrary HTML or JavaScript in the victim's browser context.

Affected (CNA)

Vendor / product	Versions
International Datacasting Corporation (IDC) / SFX Series SuperFlex Satellite Receiver Web Management Interface	affected 101

CWE

CWE-79

References

https://www.abdulmhsblog.com/posts/sfx2100-vulns/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.