CVE-2026-28778 Hardcoded FTP Credentials and LPE(via Insecure Permissions) for `xd` Local Account on IDC SFX2100
Remote attackers can use hardcoded FTP credentials to log in and overwrite root-executed binaries, achieving arbitrary code execution as root.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-28778?
CVE-2026-28778 is a high-severity vulnerability in International Datacasting Corporation (IDC) IDC SFX2100 SuperFlex Satellite Receiver, published on 4 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver contains undocumented, hardcoded/insecure credentials for the `xd` user account. A remote unauthenticated attacker can log in via FTP using these credentials. Because the `xd` user has write permissions to their home directory where root-executed binaries and symlinks (such as those invoked by `xdstartstop`) are stored, the attacker can overwrite these files or manipulate symlinks to achieve arbitrary code execution as the root user.
Weakness: CWE-798
Which versions are affected by CVE-2026-28778?
It affects 1 product.
Products include Datacast Sfx2100 Firmware.
How do I fix CVE-2026-28778?
No fix has been published for CVE-2026-28778 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-28778 being exploited?
There is no known exploitation of CVE-2026-28778 in the wild and no public exploit code.
Other vulnerabilities in International Datacasting Corporation (IDC) IDC SFX2100 SuperFlex Satellite Receiver
- CVE-2026-28775 Unauthenticated RCE via SNMP Default Writable Community String
- CVE-2026-28773 Authenticated OS Command Injection via Ping Utility Leading to RCE as Root
- CVE-2026-28774 Authenticated OS Command Injection via Traceroute Utility leads to Root RCE
- CVE-2026-29127 Incorrect Permission Assignment(777) on `monitor` Users Home Directory Containing SUID Root Binaries in IDC SFX2100
- CVE-2026-28777 Hardcoded and Insecure Credentials for "User" Local Account with SSH Access On IDC SFX2100 Satellite Receiver
Sources
Also known as GHSA-56j6-vx52-7wx9.