CVE-2026-28778

Name of the Vulnerable Software and Affected Versions International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver (affected versions not specified)

Description The IDC SFX Series SuperFlex Satellite Receiver is affected by hardcoded, insecure credentials for the xd user account. A remote, unauthenticated attacker can use these credentials to log in via FTP. The xd user has write permissions to their home directory, which contains root-executed binaries and symlinks used by xdstartstop. This allows an attacker to overwrite files or manipulate symlinks to achieve arbitrary code execution as the root user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.