CVE-2026-29119

Hardcoded and Insecure Credentials for "Admin" Account providing Telnet Access on IDC SFX2100 Satellite Receiver

State: Published
Severity: 8.8 High
Published: Mar 4, 2026
Updated: Mar 5, 2026
Reserved: Mar 4, 2026

Description

International Datacasting Corporation (IDC) SFX Series SuperFlex(SFX2100) SatelliteReceiver contains hardcoded and insecure credentials for the `admin` account. A remote unauthenticated attacker can use these undocumented credentials to access the satellite system directly via the Telnet service, leading to potential system compromise.

Scores

CVSS	Score	Vector	Source
4.0	8.8 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L	Gridware

Weaknesses

CWE-798 Use of Hard-coded Credentials

Affected Products

Product	Versions
SFX2100 Series SuperFlex SatelliteReceiverInternational Datacasting Corporation (IDC)	SFX2100Affected

References

https://www.abdulmhsblog.com/posts/sfx2100-vulns/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.