CVE-2026-28778 — Hardcoded FTP Credentials and LPE(via Insecure Permissions) for `xd` Local Account on IDC SFX2100

CVE-2026-28778

Hardcoded FTP Credentials and LPE(via Insecure Permissions) for `xd` Local Account on IDC SFX2100 PUBLISHED

Description (CNA)

International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver contains undocumented, hardcoded/insecure credentials for the `xd` user account. A remote unauthenticated attacker can log in via FTP using these credentials. Because the `xd` user has write permissions to their home directory where root-executed binaries and symlinks (such as those invoked by `xdstartstop`) are stored, the attacker can overwrite these files or manipulate symlinks to achieve arbitrary code execution as the root user.

Affected (CNA)

Vendor / product	Versions
International Datacasting Corporation (IDC) / IDC SFX2100 SuperFlex Satellite Receiver	affected SFX2100

CWE

CWE-798

References

https://www.abdulmhsblog.com/posts/sfx2100-vulns/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.