CVE-2026-28777 — Hardcoded and Insecure Credentials for "User" Local Account with SSH Access On IDC SFX2100 Satellite Receiver

CVE-2026-28777

Hardcoded and Insecure Credentials for "User" Local Account with SSH Access On IDC SFX2100 Satellite Receiver PUBLISHED

Description (CNA)

International Datacasting Corporation (IDC) SFX2100 Satellite Receiver, trivial password for the `user` (usr) account. A remote unauthenticated attacker can exploit this to gain unauthorized SSH access to the system, while intially dropped into a restricted shell, an attacker can trivially spawn a complete pty to gain an appropriately interactive shell.

Affected (CNA)

Vendor / product	Versions
International Datacasting Corporation (IDC) / SFX2100 Satellite Receiver	affected SFX2100

CWE

CWE-798

References

https://www.abdulmhsblog.com/posts/sfx2100-vulns/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.