International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver Web Management Interface

• CVE-2026-28774 Critical 9.3 Authenticated OS Command Injection via Traceroute Utility leads to Root RCE 2.8%
• CVE-2026-28773 Critical 9.3 Authenticated OS Command Injection via Ping Utility Leading to RCE as Root 2.4%
• CVE-2026-28772 Medium 5.1 Reflected XSS in IDC_Logging Index endpoint 0.2%