Vulnerability · Published Mar 4, 2026 · Assigned by Gridware
CVE-2026-28774Authenticated OS Command Injection via Traceroute Utility leads to Root RCE
Critical 9.3
In plain English
A critical-severity OS command injection in SFX Series SuperFlex SatelliteReceiver Web Management Interface from International Datacasting Corporation (IDC). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.8% (higher than 86% of all known vulnerabilities).
Official description
An OS Command Injection vulnerability exists in the web-based Traceroute diagnostic utility of International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver Web Management Interface version 101. An authenticated attacker can inject arbitrary shell metacharacters (such as the pipe `|` operator) into the flags parameter, leading to the execution of arbitrary operating system commands with root privileges.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| International Datacasting Corporation (IDC) | SFX Series SuperFlex SatelliteReceiver Web Management Interface | 101 |
Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N