Vulnerability · Published Mar 5, 2026 · Assigned by Gridware
CVE-2026-29128IDC SFX2100 Satellite Receiver bgpd/ospfd/ripd/zebra Config Credential Disclosure via World-Readable Files
High 8.6
In plain English
A high-severity hard-coded credentials in SFX2100 Satellite Receiver from International Datacasting Corporation. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).
Official description
IDC SFX2100 Satellite Receiver firmware ships with multiple daemon configuration files for routing components (e.g., zebra, bgpd, ospfd, and ripd) that are owned by root but world-readable. The configuration files (e.g., zebra.conf, bgpd.conf, ospfd.conf, ripd.conf) contain hardcoded or otherwise insecure plaintext passwords (including “enable”/privileged-mode credentials). A remote actor is able to abuse the reuse/hardcoded nature of these credentials to further access other systems in the network, gain a foothold on the satellite receiver or potentially locally privilege escalate.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| International Datacasting Corporation | SFX2100 Satellite Receiver | SFX2100 |
Weakness: CWE-522, CWE-798 · Vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N