CRITICAL🇵🇱 Wersja polska

CVE-2026-29120

CVSS 9.2v4.0pub. 2026-03-04upd. 2026-03-17

The /root/anaconda-ks.cfg installation configuration file in International Datacasting Corporation (IDC) SFX Series(SFX2100) SuperFlex Satellite Receiver insecurely stores the hardcoded root password hash. The password itself is highly insecure and susceptible to offline dictionary attacks using the rockyou.txt wordlist. Because direct root SSH login is disabled, an attacker must first obtain low-privileged access to the system (e.g., via other vulnerabilities) to be able to log in as the root user. The password is hardcoded and so allows for an actor with local access on effected versions to escalate to root

CVSS Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Datacast Sfx2100

    HW
    Datacast
    wszystkie wersje

  • Datacast Sfx2100 Firmware

    OS
    Datacast
    wszystkie wersje
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2026-29127CRITICAL9.2PL ✓ten sam produkt

IDC SFX2100: błędne uprawnienia katalogu umożliwiają privilege escalation

CVE-2026-28777CRITICAL9.2PL ✓ten sam produkt

Hardcoded hasło w urządzeniu IDC SFX2100 – nieautoryzowany dostęp SSH

CVE-2026-28774CRITICAL9.3PL ✓ten sam produkt

Command Injection w narzędziu Traceroute interfejsu IDC SFX2100

CVE-2026-28773CRITICAL9.3PL ✓ten sam produkt

Command injection w narzędziu diagnostycznym Ping urządzenia IDC SFX2100

CVE-2026-28775CRITICAL10.0PL ✓ten sam produkt

RCE jako root przez SNMP w odbiorniku IDC SFX Series SuperFlex