Vulnerability · Published Mar 4, 2026 · Assigned by Gridware

CVE-2026-29119Hardcoded and Insecure Credentials for "Admin" Account providing Telnet Access on IDC SFX2100 Satellite Receiver

High 8.8

In plain English

A high-severity hard-coded credentials in SFX2100 Series SuperFlex SatelliteReceiver from International Datacasting Corporation (IDC). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 46% of all known vulnerabilities).

Severity (CVSS 4.0)8.8High

Exploit odds (30 days)0.6%top 53.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

International Datacasting Corporation (IDC) SFX Series SuperFlex(SFX2100) SatelliteReceiver contains hardcoded and insecure credentials for the `admin` account. A remote unauthenticated attacker can use these undocumented credentials to access the satellite system directly via the Telnet service, leading to potential system compromise.

Affected products (as reported)

Vendor	Product	Versions
International Datacasting Corporation (IDC)	SFX2100 Series SuperFlex SatelliteReceiver	SFX2100

Weakness: CWE-798 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L

References

https://www.abdulmhsblog.com/posts/sfx2100-vulns/