CVE-2026-28777 is a critical (CVSS 9.8) flaw in the International Datacasting Corporation SFX2100 satellite receiver. A user account has a trivial password, giving a remote attacker SSH access. I could not confirm a vendor fix, so limit SSH to a management host and ask the vendor.
What's affected
The record names the IDC SFX2100 Satellite Receiver and its firmware. The affected account is user (usr), reachable over SSH. The login starts in a restricted shell, which the record says can be turned into a fully interactive one.
The only reference in the record is a researcher's blog post, which says the vendor did not respond during disclosure. I found no vendor advisory or fixed firmware version, so treat the issue as unpatched until the vendor says otherwise.
How to check if you're exposed
Find SFX2100 units on your network and test reachability of SSH from outside the management segment using your own scanning tools. Review your authorized device configuration for account lists.
What to do now
- Inventory every SFX2100 and related SFX unit.
- Block SSH except from an isolated management host.
- Change or disable the account password where the device allows it, and document the change.
- Log and alert on SSH sessions to these devices.
- Request firmware and a security statement from IDC.
Why it matters
The record lists CWE-798, use of hard-coded credentials. Together with sibling CVEs for the same receiver, it describes several separate ways in, so closing one account is not enough on its own.
The device is described in the researcher's post as used by government and critical infrastructure customers. Plan on network isolation as the main defense. The record does not mark the CVE as exploited in the wild.
Quick check
Does the restricted shell limit the damage?
The record says it can be escaped to a full interactive shell, so do not count on it as a control.
Sources
Last reviewed: 19 October 2026.
