CVE-2026-29119 is a critical flaw (CVSS 9.8) in the International Datacasting SFX2100 SuperFlex satellite receiver. The admin account has hardcoded, undocumented credentials that work on the Telnet service. The record names no fixed firmware, so block Telnet access and ask the vendor for guidance.
What's affected
The NVD record lists the IDC SFX2100 receiver and its firmware. It does not give a version range or a fixed firmware release. The researcher's write-up covers many findings on the same device, and this CVE is the hardcoded credentials issue for the admin account on Telnet.
As a result, treat every unit as affected until IDC confirms otherwise.
How to check if you're exposed
Find out where SFX2100 units are installed and whether Telnet is reachable on them. From a management host, check whether TCP port 23 is open on each receiver's address:
nmap -p 23 receiver-address
Also review firewall rules and routing to see which networks can reach the units. Receivers on a flat management network or exposed through a remote access path are at the highest risk.
What to do now
- Block Telnet to the receivers at the firewall and allow management only from a small trusted network or jump host.
- Contact International Datacasting for firmware or configuration guidance, since the record names no fix.
- If the device lets you disable Telnet, do so and use a protected alternative.
- Review logs and device state for sign-ins you cannot explain, and plan to rebuild a unit if you find any.
- Record all units in your asset inventory with their firmware version, so you can act when a fix appears.
Why it matters
The record files this under CWE-798, use of hardcoded credentials. The same password ships on every device, so anyone who learns it can sign in to any unit that is reachable. Hardcoded logins also cannot be changed by the operator in the usual way, which is why a vendor update or a network control is the only remedy.
The NVD vector rates it as network reachable with no privileges, which is what makes the Telnet exposure serious. Satellite receivers often sit in critical broadcast or data distribution chains, and network placement is the control you own today. The record does not mark this as exploited in the wild.
Quick check
Is there a firmware fix?
The record does not name one. Ask the vendor.
What is the fastest mitigation?
Block Telnet to the device and limit management access to a trusted network.
Sources
Last reviewed: 19 October 2026.
