Vulnerability · Published Mar 4, 2026 · Assigned by Gridware
CVE-2026-28775Unauthenticated RCE via SNMP Default Writable Community String
Critical 10.0
In plain English
A critical-severity security flaw in SFX2100 Series SuperFlex SatelliteReceiver from International Datacasting Corporation (IDC). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities).
Official description
An unauthenticated Remote Code Execution (RCE) vulnerability exists in the SNMP service of International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver. The deployment insecurely provisions the `private` SNMP community string with read/write access by default. Because the SNMP agent runs as root, an unauthenticated remote attacker can utilize `NET-SNMP-EXTEND-MIB` directives, abusing the fact that the system runs a vulnerable version of net-snmp pre 5.8, to execute arbitrary operating system commands with root privileges.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| International Datacasting Corporation (IDC) | SFX2100 Series SuperFlex SatelliteReceiver | SFX2100 |
Weakness: CWE-1188 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H