CVE-2026-28776 — Hardcoded and Insecure Credentials for "monitor" account with SSH Access On IDC SFX2100 Satellite Receiver

CVE-2026-28776

Hardcoded and Insecure Credentials for "monitor" account with SSH Access On IDC SFX2100 Satellite Receiver PUBLISHED

Description (CNA)

International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver contains hardcoded credentials for the `monitor` account. A remote unauthenticated attacker can use these trivial, undocumented credentials to access the system via SSH. While initially dropped into a restricted shell, the attacker can trivially break out to achieve standard shell functionality.

Affected (CNA)

Vendor / product	Versions
International Datacasting Corporation (IDC) / IDC SFX2100 SuperFlex Satellite Receiver	affected SFX2100

CWE

CWE-798

References

https://www.abdulmhsblog.com/posts/sfx2100-vulns/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.