International Datacasting Corporation's SFX2100 SuperFlex satellite receiver carries five separate hardcoded-credential vulnerabilities, disclosed on March 4, 2026, that let a remote attacker log in over Telnet, SSH or FTP without ever touching a real password. Security researcher Abdul Mhanni found the flaws and reported them through Gridware, an Australian CVE Numbering Authority, after which MITRE assigned five separate CVE identifiers covering the same device family.
Five Ways In
CVE-2026-29119 covers a built-in admin account reachable over Telnet with undocumented, hardcoded credentials. CVE-2026-28777 exposes a similarly hardcoded password for the SSH-accessible "user" account; that account starts in a restricted shell, but Mhanni's write-up notes an attacker can trivially spawn a full interactive pty to break out of it. CVE-2026-28778 is arguably the worst of the set: hardcoded FTP credentials for an account named "xd" that has write access to directories holding binaries root executes, a path a remote unauthenticated attacker can use to reach root code execution.
CVE-2026-29120 stores a root password hash directly inside the receiver's installation file, /root/anaconda-ks.cfg, left over from a Kickstart-based Linux build. Direct root SSH login is disabled, so exploiting it requires a foothold first, but an offline dictionary attack against that hash remains feasible once an attacker gets local access. The last flaw, CVE-2026-29128, found that the receiver's bundled routing daemon configuration files, for zebra, bgpd, ospfd and ripd, are world-readable and store plaintext privileged-mode passwords. NVD lists it under CVSS 3.1 as a 10.0, the maximum possible critical score, though the newer CVSS 4.0 scoring puts it lower, at 8.6.
Built for Government Data Distribution
The SFX2100 SuperFlex belongs to a hardware line IDC has sold since the 2000s to distribute audio, video and data over DVB-S/S2 satellite links to broadcasters and enterprises. In 2013 the company won a contract to expand a US government satellite broadcast network, supplying SuperFlex Pro Data receivers that decrypt and route data files and live streams to remote government agencies worldwide. IDC itself was absorbed into Novra Technologies in a 2016 merger, and the SuperFlex line has continued under that ownership, which is why current vulnerability trackers now file the device under the "Datacast" vendor name rather than IDC's own.
No Patch, Mixed Signals on Exploitation
None of the five CVEs appear in CISA's Known Exploited Vulnerabilities catalog, and trackers disagree on whether a public proof-of-concept circulates for any of them. What is consistent across NVD, the CVE.org record and third-party trackers is that no vendor fix has shipped for any of the five flaws as of this writing. Gridware's advisory recommends the usual stopgaps for operators who cannot pull a receiver from service immediately: restrict Telnet, SSH and FTP access to trusted management networks only, rotate every hardcoded or default password the device ships with, and tighten file permissions on the routing daemon configs so they stop being world-readable.
Because the SFX2100 sits inside the kind of enterprise and government satellite distribution networks the 2013 contract describes, a single unpatched unit on an exposed management interface could hand an attacker a route not just into the receiver itself, but into whatever downstream network depends on the data feed it decrypts.
First reported in Gridware's security advisories and tracked publicly through the National Vulnerability Database.
