cvedb.io
CVE-2026-28777
CRITICAL · CVSS 9.8
EPSS exploitation probability: 0%
Published 2026-03-04T08:16:14.113 · Last modified 2026-06-17T10:29:01.427

Summary

International Datacasting Corporation (IDC) SFX2100 Satellite Receiver, trivial password for the `user` (usr) account. A remote unauthenticated attacker can exploit this to gain unauthorized SSH access to the system, while intially dropped into a restricted shell, an attacker can trivially spawn a complete pty to gain an appropriately interactive shell.

Affected products

datacast — sfx2100_firmware

Does this affect you?

Add your gear to cvedb and we'll alert you only when datacast ships something exploited.

Check my exposure →

References

This product uses data from the NVD API but is not endorsed or certified by the NVD. Informational only; not professional security advice.