Hardcoded FTP Credentials and LPE(via Insecure Permissions) for `xd` Local Account on IDC SFX2100

Description

International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver contains undocumented, hardcoded/insecure credentials for the `xd` user account. A remote unauthenticated attacker can log in via FTP using these credentials. Because the `xd` user has write permissions to their home directory where root-executed binaries and symlinks (such as those invoked by `xdstartstop`) are stored, the attacker can overwrite these files or manipulate symlinks to achieve arbitrary code execution as the root user.

Scores

EPSS (exploitation in 30 days)

0.94% · top 39% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.9.

Weakness

• CWE-798 Use of Hard-coded Credentials (opens in a new tab)All about CWE-798 and its CVEs

Affected products

• International Datacasting Corporation (IDC) · IDC SFX2100 SuperFlex Satellite Receiver

  • affected SFX2100

References (1)

• https://www.abdulmhsblog.com/posts/sfx2100-vulns/ (opens in a new tab)

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-28778](https://trackcve.app/badge/CVE-2026-28778.svg)](https://trackcve.app/cve/CVE-2026-28778)

Record last updated 5 Mar 2026, 05:58 UTC.