CVE-2026-28774 — Authenticated OS Command Injection via Traceroute Utility leads to Root RCE

CVE-2026-28774

Authenticated OS Command Injection via Traceroute Utility leads to Root RCE PUBLISHED

Description (CNA)

An OS Command Injection vulnerability exists in the web-based Traceroute diagnostic utility of International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver Web Management Interface version 101. An authenticated attacker can inject arbitrary shell metacharacters (such as the pipe `|` operator) into the flags parameter, leading to the execution of arbitrary operating system commands with root privileges.

Affected (CNA)

Vendor / product	Versions
International Datacasting Corporation (IDC) / SFX Series SuperFlex SatelliteReceiver Web Management Interface	affected 101

CWE

CWE-78

References

https://www.abdulmhsblog.com/posts/sfx2100-vulns/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.