Vulnerability · Published Mar 4, 2026 · Assigned by Gridware
CVE-2026-28771Reflected XSS In /index.cgi Endpoint On IDC Satellite Receiver Web Management Interface Version 101
Medium 5.1
In plain English
A medium-severity cross-site scripting in SFX Series SuperFlex Satellite Receiver Web Management Interface from International Datacasting Corporation (IDC). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).
Official description
A Reflected Cross-Site Scripting (XSS) vulnerability exists in the /index.cgi endpoint of International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web Management Interface version 101. The application fails to adequately sanitize user-supplied input provided via the `cat` parameter before reflecting it in the HTTP response, allowing a remote attacker to execute arbitrary HTML or JavaScript in the victim's browser context.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| International Datacasting Corporation (IDC) | SFX Series SuperFlex Satellite Receiver Web Management Interface | 101 |
Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N