CVE-2026-28775: Unauthenticated Root RCE in IDC SFX

Root-Level RCE on Satellite Receivers — No Authentication Required

International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receivers are affected by a critical unauthenticated remote code execution vulnerability tracked as CVE-2026-28775, published to the National Vulnerability Database (NVD) on March 4, 2026.

The flaw stems from an insecure default: the device provisions the private SNMP community string with read/write access out of the box. Because the underlying SNMP agent runs as root, any unauthenticated attacker with network access to port 161/UDP can abuse NET-SNMP-EXTEND-MIB directives to execute arbitrary operating system commands with full root privileges — no credentials, no user interaction required.

This is part of a broader cluster of vulnerabilities (CVE-2026-28771 through CVE-2026-28778) affecting the same IDC SFX product line, including multiple OS command injection and cross-site scripting flaws.

Vulnerability Details

How the Vulnerability Works

Step 1: Default SNMP Community String

IDC SFX Series devices ship with the SNMP private community string configured with read/write access by default. This is a well-known insecure default that is trivially guessable or discoverable via scanning tools.

Step 2: SNMP Agent Running as Root

The SNMP service on the device runs with root-level privileges. This means any action taken through the SNMP service inherits the highest privilege level on the system.

Step 3: NET-SNMP-EXTEND-MIB Abuse

The device runs a vulnerable version of net-snmp prior to 5.8. This version supports the NET-SNMP-EXTEND-MIB, which allows administrators to define custom scripts executable via SNMP queries. An attacker abuses this legitimate feature to register and execute arbitrary OS commands:

snmpset -v2c -c private <target_ip> NET-SNMP-EXTEND-MIB::nsExtendCommand.\"cmd\" s \"/bin/sh\"
snmpset -v2c -c private <target_ip> NET-SNMP-EXTEND-MIB::nsExtendArgs.\"cmd\" s \"-c 'id'\"
snmpget -v2c -c private <target_ip> NET-SNMP-EXTEND-MIB::nsExtendOutput1Line.\"cmd\"

The result is unauthenticated root-level command execution on the satellite receiver.

Related CVE Cluster (IDC SFX Series)

The IDC SFX product line was disclosed with multiple vulnerabilities simultaneously:

The cluster suggests a security audit or independent research disclosure rather than a single targeted discovery.

Impact Assessment

Recommendations

For Network Administrators

1. Change the default SNMP community string immediately — replace private with a strong, unique string or disable SNMP write access entirely
2. Firewall SNMP port 161/UDP — restrict access to trusted management hosts only; SNMP should never be internet-facing
3. Disable SNMP if not required — if SNMP management is not actively used, disable the service on the device
4. Audit all IDC SFX devices on your network for default configurations

For Security Teams

1. Scan for CVE-2026-28775 in vulnerability management platforms once signatures are available
2. Check for exposure — identify any IDC SFX receivers with SNMP accessible from untrusted VLANs or the internet
3. Review the full CVE cluster (CVE-2026-28771 through CVE-2026-28778) — web management interface vulnerabilities should also be addressed
4. Monitor for vendor patch — IDC has not yet confirmed a patched firmware version; watch for updates

Key Takeaways

1. CVE-2026-28775 enables unauthenticated root RCE through a trivially-exploitable default SNMP community string — no credentials needed
2. The SNMP agent running as root transforms a misconfiguration into a complete device compromise
3. Six CVEs were disclosed simultaneously across the IDC SFX product line, suggesting the devices have not been subject to regular security review
4. Satellite and broadcast receivers are often overlooked in enterprise and infrastructure security programs despite their network connectivity
5. No patch is confirmed — mitigation is entirely configuration-dependent until IDC releases updated firmware
6. CWE-1188 (insecure defaults) is a recurring class of vulnerability in embedded and IoT devices that continues to affect operational technology environments

Sources

• CVE-2026-28775 — NVD
• CVE-2026-28775 — OffSeq Threat Radar
• CVE-2026-28775 — CIRCL Vulnerability Lookup
• CVE-2026-28775 — THREATINT