CVE-2026-28774

The vulnerability (CWE-78) results from insufficient validation and sanitization of input data passed to the 'flags' parameter in the web-based Traceroute tool. An attacker can inject special shell metacharacters, such as the pipe operator '|', which are not filtered before being passed to the operating system. As a result, the shell interpreter executes additional arbitrary OS commands appended by the attacker. These commands are executed with root privileges, giving full control over the device.

An authenticated attacker gains the ability to execute arbitrary operating system commands with root privileges, resulting in complete takeover of the device and potential compromise of the satellite infrastructure to which the device is connected.

Apply patches available from the manufacturer according to the references. Until the fix is implemented, it is recommended to restrict access to the Web Management Interface only to trusted hosts and implement strong authentication and network segmentation.

International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver — firmware version 101 (product: SFX2100)