CVE-2026-29120

Name of the Vulnerable Software and Affected Versions IDC SFX Series(SFX2100) SuperFlex Satellite Receiver (affected versions not specified)

Description The /root/anaconda-ks.cfg installation configuration file insecurely stores a hardcoded root password hash. This password is highly susceptible to offline dictionary attacks, such as those using the rockyou.txt wordlist. An attacker requires initial low-privileged access to the system to exploit this issue and escalate to root privileges, as direct root SSH login is disabled. The API endpoint /root/anaconda-ks.cfg is involved in this issue. The vulnerable variable is the hardcoded root password hash within the configuration file.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.