Sfx Series Superflex Satellitereceiver Web Management Interface
Approved changes feed: RSS · Atom
cpe:2.3:a:international_datacasting_corporation_(idc):sfx_series_superflex_satellitereceiver_web_management_interface:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | International Datacasting Corporation (Idc) (282b45a7-0b11-5930-9a66-e046bf74c301) |
|---|---|
| Product | Sfx Series Superflex Satellitereceiver Web Management Interface (8af38419-8582-506f-bbee-7a06c0564e27) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-28774 |
vulnerable | 2026-06-08 07:55:15.639975 |
Authenticated OS Command Injection via Traceroute Utility leads to Root RCE
An OS Command Injection vulnerability exists in the web-based Traceroute diagnostic utility of International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver Web Management Interface version 101. An authenticated attacker can inject arbitrary shell metacharacters (such as the pipe `|` operator) into the flags parameter, leading to the execution of arbitrary operating system commands with root privileges.
Published: 2026-03-04T07:22:57.677Z
Updated: 2026-03-05T05:59:55.331Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-28773 |
vulnerable | 2026-06-08 07:55:15.639622 |
Authenticated OS Command Injection via Ping Utility Leading to RCE as Root
The web-based Ping diagnostic utility (/IDC_Ping/main.cgi) in International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web Management Interface version 101 is vulnerable to OS Command Injection. The application insecurely parses the `IPaddr` parameter. An authenticated attacker can bypass server-side semicolon exclusion checks by using alternate shell metacharacters (such as the pipe `|` operator) to append and execute arbitrary shell commands with root privileges.
Published: 2026-03-04T07:16:58.715Z
Updated: 2026-03-05T06:00:17.350Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-28772 |
vulnerable | 2026-06-08 07:55:15.638978 |
Reflected XSS in IDC_Logging Index endpoint
A Reflected Cross-Site Scripting (XSS) vulnerability in the /IDC_Logging/index.cgi endpoint of International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver Web Management Interface version 101 allows a remote attacker to execute arbitrary web scripts or HTML. The vulnerability is triggered by sending a crafted payload through the `submitType` parameter, which is reflected directly into the DOM without proper escaping.
Published: 2026-03-04T07:12:53.143Z
Updated: 2026-03-05T06:00:30.449Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.