CVE-2026-28776

Impact

International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver contains hardcoded credentials for the `monitor` account. A remote unauthenticated attacker can use these trivial, undocumented credentials to access the system via SSH. While initially dropped into a restricted shell, the attacker can trivially break out to achieve standard shell functionality.

Affected products

Weakness classification

References

• NVD record
• CVE.org record
• https://www.abdulmhsblog.com/posts/sfx2100-vulns/