CVE-2026-28777

The vulnerability results from the use of a hardcoded, easily guessable password assigned to the 'user' (usr) account in the SFX2100 device firmware (CWE-798). An attacker can remotely log in via SSH without knowledge of any credentials other than this trivial password. Although the session is initially restricted to a restricted shell after login, the attacker can easily launch a full interactive PTY environment, thereby gaining broader access to the system.

An attacker gains remote, unauthorized access to the device's operating system from an interactive shell session, enabling further system exploration, lateral movement in the network, and potential compromise of satellite infrastructure managed by the device.

Patches available from the manufacturer should be applied according to the references. Until the patch is implemented, it is recommended to block SSH access to the device at the firewall level, isolate the device in a dedicated network segment, and change the default password for the 'user' account if the firmware allows it.

Datacast SFX2100 Satellite Receiver – firmware (Datacast Sfx2100 Firmware) and Datacast Sfx2100 device; specific firmware versions indicated in the manufacturer's references