Vulnerability · Published Mar 4, 2026 · Assigned by Gridware
CVE-2026-28776Hardcoded and Insecure Credentials for "monitor" account with SSH Access On IDC SFX2100 Satellite Receiver
High 7.8
In plain English
A high-severity hard-coded credentials in IDC SFX2100 SuperFlex Satellite Receiver from International Datacasting Corporation (IDC). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 46% of all known vulnerabilities).
Official description
International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver contains hardcoded credentials for the `monitor` account. A remote unauthenticated attacker can use these trivial, undocumented credentials to access the system via SSH. While initially dropped into a restricted shell, the attacker can trivially break out to achieve standard shell functionality.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| International Datacasting Corporation (IDC) | IDC SFX2100 SuperFlex Satellite Receiver | SFX2100 |
Weakness: CWE-798 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:L/SA:N