CVE-2026-28771

Name of the Vulnerable Software and Affected Versions International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web Management Interface version 101

Description A Reflected Cross-Site Scripting (XSS) issue exists in the /index.cgi API endpoint. The application does not properly sanitize user-supplied input received through the cat parameter before including it in the HTTP response. This allows a remote attacker to execute arbitrary HTML or JavaScript code within a victim’s browser.

Recommendations Apply input validation and output encoding to the cat parameter in the /index.cgi endpoint to prevent the injection of malicious scripts.