https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-29128.htmlhttps://patchthecve.com/cve/CVE-2026-29128.htmlWed, 17 Jun 2026 10:29:40 +0000CRITICAL 10.0: IDC SFX2100 Satellite Receiver firmware ships with multiple daemon configuration files for routing components (e.g., zebra, bgpd, ospfd, and ripd) that are owned by root but world-readable. The configuration files (e.g., zebra.conf, bgpd.conf, ospfd.conf, ripd.conf) contain hardcoded or otherwise inhttps://patchthecve.com/cve/CVE-2026-29127.htmlhttps://patchthecve.com/cve/CVE-2026-29127.htmlWed, 17 Jun 2026 10:29:40 +0000HIGH 7.8: The IDC SFX2100 Satellite Receiver sets overly permissive file system permissions on the monitor user's home directory. The directory is configured with permissions 0777, granting read, write, and execute access to all local users on the system, which may cause local privilege escalation depending ohttps://patchthecve.com/cve/CVE-2026-29126.htmlhttps://patchthecve.com/cve/CVE-2026-29126.htmlWed, 17 Jun 2026 10:29:39 +0000HIGH 7.8: Incorrect permission assignment (world-writable file) in /etc/udhcpc/default.script in International Data Casting (IDC) SFX2100 Satellite Receiver allows a local unprivileged attacker to potentially execute arbitrary commands with root privileges (local privilege escalation and persistence) via modihttps://patchthecve.com/cve/CVE-2026-29125.htmlhttps://patchthecve.com/cve/CVE-2026-29125.htmlWed, 17 Jun 2026 10:29:39 +0000MEDIUM 4.7: IDC SFX2100 Satalite Recievers set the `/etc/resolv.conf` file to be world-writable by any local user, allowing DNS resolver tampering that can redirect network communications, facilitate man-in-the-middle attacks, and cause denial of service.https://patchthecve.com/cve/CVE-2026-29124.htmlhttps://patchthecve.com/cve/CVE-2026-29124.htmlWed, 17 Jun 2026 10:29:39 +0000HIGH 7.8: Multiple SUID root-owned binaries are found in /home/monitor/terminal, /home/monitor/kore-terminal, /home/monitor/IDE-DPack/terminal-dpack, and /home/monitor/IDE-DPack/terminal-dpack2 in International Data Casting (IDC) SFX2100 Satellite Receiver, which may lead to local privlidge escalation from thhttps://patchthecve.com/cve/CVE-2026-29123.htmlhttps://patchthecve.com/cve/CVE-2026-29123.htmlWed, 17 Jun 2026 10:29:39 +0000HIGH 7.8: A SUID root-owned binary in /home/xd/terminal/XDTerminal in International Data Casting (IDC) SFX2100 on Linux allows a local actor to potentially preform local privilege escalation depending on conditions of the system via execution of the affected SUID binary. This can be via PATH hijacking, symlinhttps://patchthecve.com/cve/CVE-2026-29122.htmlhttps://patchthecve.com/cve/CVE-2026-29122.htmlWed, 17 Jun 2026 10:29:39 +0000MEDIUM 5.5: International Data Casting (IDC) SFX2100 satellite receiver comes with the `/bin/date` utility installed with the setuid bit set. This configuration grants elevated privileges to any local user who can execute the binary. A local actor is able to use the GTFObins resource to preform privileged file https://patchthecve.com/cve/CVE-2026-29121.htmlhttps://patchthecve.com/cve/CVE-2026-29121.htmlWed, 17 Jun 2026 10:29:38 +0000HIGH 7.8: International Data Casting (IDC) SFX2100 satellite receiver comes with the `/sbin/ip` utility installed with the setuid bit set. This configuration grants elevated privileges to any local user who can execute the binary. A local actor is able to use the GTFObins resource to preform privileged file rhttps://patchthecve.com/cve/CVE-2026-29120.htmlhttps://patchthecve.com/cve/CVE-2026-29120.htmlWed, 17 Jun 2026 10:29:37 +0000HIGH 7.8: The /root/anaconda-ks.cfg installation configuration file in International Datacasting Corporation (IDC) SFX Series(SFX2100) SuperFlex Satellite Receiver insecurely stores the hardcoded root password hash. The password itself is highly insecure and susceptible to offline dictionary attacks using thehttps://patchthecve.com/cve/CVE-2026-29119.htmlhttps://patchthecve.com/cve/CVE-2026-29119.htmlWed, 17 Jun 2026 10:29:37 +0000CRITICAL 9.8: International Datacasting Corporation (IDC) SFX Series SuperFlex(SFX2100) SatelliteReceiver contains hardcoded and insecure credentials for the `admin` account. A remote unauthenticated attacker can use these undocumented credentials to access the satellite system directly via the Telnet service, lehttps://patchthecve.com/cve/CVE-2026-28778.htmlhttps://patchthecve.com/cve/CVE-2026-28778.htmlWed, 17 Jun 2026 10:29:01 +0000CRITICAL 9.8: International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver contains undocumented, hardcoded/insecure credentials for the `xd` user account. A remote unauthenticated attacker can log in via FTP using these credentials. Because the `xd` user has write permissions to their homehttps://patchthecve.com/cve/CVE-2026-28777.htmlhttps://patchthecve.com/cve/CVE-2026-28777.htmlWed, 17 Jun 2026 10:29:01 +0000CRITICAL 9.8: International Datacasting Corporation (IDC) SFX2100 Satellite Receiver, trivial password for the `user` (usr) account. A remote unauthenticated attacker can exploit this to gain unauthorized SSH access to the system, while intially dropped into a restricted shell, an attacker can trivially spawn ahttps://patchthecve.com/cve/CVE-2026-28776.htmlhttps://patchthecve.com/cve/CVE-2026-28776.htmlWed, 17 Jun 2026 10:29:01 +0000CRITICAL 9.8: International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver contains hardcoded credentials for the `monitor` account. A remote unauthenticated attacker can use these trivial, undocumented credentials to access the system via SSH. While initially dropped into a restricted shellhttps://patchthecve.com/cve/CVE-2026-28775.htmlhttps://patchthecve.com/cve/CVE-2026-28775.htmlWed, 17 Jun 2026 10:29:01 +0000CRITICAL 9.8: An unauthenticated Remote Code Execution (RCE) vulnerability exists in the SNMP service of International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver. The deployment insecurely provisions the `private` SNMP community string with read/write access by default. Because the SNMP https://patchthecve.com/cve/CVE-2026-28774.htmlhttps://patchthecve.com/cve/CVE-2026-28774.htmlWed, 17 Jun 2026 10:29:01 +0000HIGH 8.8: An OS Command Injection vulnerability exists in the web-based Traceroute diagnostic utility of International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver Web Management Interface version 101. An authenticated attacker can inject arbitrary shell metacharacters (such as the piphttps://patchthecve.com/cve/CVE-2026-28773.htmlhttps://patchthecve.com/cve/CVE-2026-28773.htmlWed, 17 Jun 2026 10:29:00 +0000HIGH 8.8: The web-based Ping diagnostic utility (/IDC_Ping/main.cgi) in International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite  Receiver Web Management Interface version 101 is vulnerable to OS Command Injection. The application insecurely parses the `IPaddr` parameter. An authenticated athttps://patchthecve.com/cve/CVE-2026-28772.htmlhttps://patchthecve.com/cve/CVE-2026-28772.htmlWed, 17 Jun 2026 10:29:00 +0000MEDIUM 6.1: A Reflected Cross-Site Scripting (XSS) vulnerability in the /IDC_Logging/index.cgi endpoint of International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver Web Management Interface version 101 allows a remote attacker to execute arbitrary web scripts or HTML. The vulnerability https://patchthecve.com/cve/CVE-2026-28771.htmlhttps://patchthecve.com/cve/CVE-2026-28771.htmlWed, 17 Jun 2026 10:29:00 +0000MEDIUM 6.1: A Reflected Cross-Site Scripting (XSS) vulnerability exists in the /index.cgi endpoint of International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web Management Interface version 101. The application fails to adequately sanitize user-supplied input provided via the `cat` https://patchthecve.com/cve/CVE-2026-28770.htmlhttps://patchthecve.com/cve/CVE-2026-28770.htmlWed, 17 Jun 2026 10:29:00 +0000HIGH 8.8: Improper neutralization of special elements in the /IDC_Logging/checkifdone.cgi script in International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web management Interface version 101 allows for XML Injection. The application reflects un-sanitized user input from the `filehttps://patchthecve.com/cve/CVE-2026-28769.htmlhttps://patchthecve.com/cve/CVE-2026-28769.htmlWed, 17 Jun 2026 10:29:00 +0000MEDIUM 6.5: A path traversal vulnerability exists in the /IDC_Logging/checkifdone.cgi script in International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web management portal version 101. An authenticated attacker can manipulate the `file` parameter to traverse directories and enumera