CVE-2026-29120

The file /root/anaconda-ks.cfg contains a hardcoded root user password hash. This password is simple enough to be cracked offline using popular wordlists such as rockyou.txt. Since direct root login via SSH is disabled, an attacker must first obtain access with low privileges (e.g., through other vulnerabilities), and then use the recovered password to escalate privileges to the root account.

An attacker with local, unprivileged access to the system can take full control of the device as root, obtaining unlimited access to its resources and configuration, as well as to connected systems (high impact on confidentiality and integrity in system context).

Apply patches available from the manufacturer according to references. As interim measures, it is recommended to change the default root password to a strong, unique password and restrict local access to the device to trusted users only. The file /root/anaconda-ks.cfg should be secured or deleted.

International Datacasting Corporation (IDC) SFX2100 SuperFlex Satellite Receiver — Datacast SFX2100 firmware (versions indicated in manufacturer references)