Vulnerability · Published Mar 4, 2026 · Assigned by Gridware
CVE-2026-28777Hardcoded and Insecure Credentials for "User" Local Account with SSH Access On IDC SFX2100 Satellite Receiver
Critical 9.2
In plain English
A critical-severity hard-coded credentials in SFX2100 Satellite Receiver from International Datacasting Corporation (IDC). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 46% of all known vulnerabilities).
Official description
International Datacasting Corporation (IDC) SFX2100 Satellite Receiver, trivial password for the `user` (usr) account. A remote unauthenticated attacker can exploit this to gain unauthorized SSH access to the system, while intially dropped into a restricted shell, an attacker can trivially spawn a complete pty to gain an appropriately interactive shell.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| International Datacasting Corporation (IDC) | SFX2100 Satellite Receiver | SFX2100 |
Weakness: CWE-798 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N