CVE-2026-28776 is a critical (CVSS 9.8) hardcoded credential flaw in International Datacasting Corporation SFX Series SuperFlex satellite receivers. A monitor account with trivial, undocumented credentials allows SSH access from the network. I could not confirm a fix, so block SSH and contact the vendor.
What's affected
The record names the SFX Series SuperFlex SatelliteReceiver and its firmware, including the SFX2100. The affected account is monitor, reachable over SSH. The record says the login lands in a restricted shell that can be broken out of.
The only reference in the record is a researcher's blog post, which says the vendor did not respond during disclosure. I found no vendor advisory or fixed firmware version, so treat the issue as unpatched until the vendor says otherwise.
How to check if you're exposed
List which SFX receivers are reachable over SSH (TCP 22) and from where. Look at the device's account list if you have authorized access. Do not try to log in to devices you are not responsible for.
What to do now
- Inventory every IDC SFX receiver.
- Block SSH to the devices except from a hardened management host or jump box.
- Where the platform allows it, disable or change the credentials of undocumented accounts, and record what you changed.
- Monitor logs for SSH logins from unexpected sources.
- Ask the vendor for a firmware update and a written security statement.
Why it matters
This is CWE-798, use of hard-coded credentials. A password that ships in every unit and is not in the documentation cannot be rotated by the owner in the normal way, and once found it works on every device of that model.
The researcher write-up lists many related issues in the same device, which suggests weak security practice in the product rather than a single mistake. The record does not mark this CVE as exploited in the wild.
Quick check
Why are hardcoded credentials worse than weak passwords?
A weak password can be changed by the owner. A hardcoded one is built into the firmware, so the same login works on many devices until the vendor ships a fix.
Sources
Last reviewed: 19 October 2026.
