CVE-2026-28773

The vulnerability is located in the CGI script of the Ping diagnostic tool available at the path /IDC_Ping/main.cgi. The application improperly processes the `IPaddr` parameter — although semicolon (`;`) filtering is implemented on the server side, this protection can be bypassed using alternative shell metacharacters such as the pipe operator (`|`). An attacker, after authenticating to the web interface, can inject and execute arbitrary system commands that will be executed with root privileges.

An attacker can gain full control of the device by executing arbitrary commands with root privileges, enabling configuration modifications, malicious software installation, and lateral movement within the network.

Apply patches available from the manufacturer according to the references. Additionally, it is recommended to restrict access to the web management interface only to trusted networks or IP addresses and implement multi-factor authentication where possible.

International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver, firmware version 101 (product: Datacast SFX2100 / SFX2100 Firmware)