CVE-2026-28778 is a critical (CVSS 9.8) flaw in International Datacasting Corporation SFX Series SuperFlex receivers. Undocumented credentials for the xd account allow FTP login, and writable files that root executes can lead to code running as root. I found no confirmed fix, so isolate these devices.
What's affected
The record names the SFX Series SuperFlex Satellite Receiver and firmware. The affected account is xd, reachable over FTP, and its home directory holds binaries and symlinks, such as those used by xdstartstop, that root executes.
The only reference in the record is a researcher's blog post, which says the vendor did not respond during disclosure. I found no vendor advisory or fixed firmware version, so treat the issue as unpatched until the vendor says otherwise.
How to check if you're exposed
Check whether any SFX receiver exposes FTP (TCP 21) beyond its management network. Review device permissions on the home directory of the xd account if you have authorized access.
What to do now
- Inventory SFX receivers across sites.
- Block FTP to the devices from everything except a trusted management host, and prefer disabling the service if it is not needed.
- Change or disable the account credentials where the platform allows.
- Monitor for FTP logins and file changes in the account's home directory.
- Ask the vendor for fixed firmware and corrected permissions.
Why it matters
The record lists CWE-798, hard-coded credentials, and describes insecure permissions as the step from file access to root. The pairing matters. A low-privilege login is much more dangerous when it can write files that a privileged process later runs.
Privilege separation fails when root-run files are writable by a lesser account. That is a design issue, and it is why a firmware update, not a configuration change alone, is the real fix. The record does not mark the CVE as exploited in the wild.
Quick check
Why does a writable home directory matter?
Because root runs files stored there. Anyone who can log in and replace those files can make root run their content.
Sources
Last reviewed: 19 October 2026.
