CVE-2026-28769

{"id": "CVE-2026-28769", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28769", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-04T15:02:36.511887Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "b7efe717-a805-47cf-8e9a-921fca0ce0ce", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "b7efe717-a805-47cf-8e9a-921fca0ce0ce", "affectedData": [{"vendor": "International Datacasting Corporation (IDC)", "product": "SFX Series SuperFlex Satellite Receiver Web management interface", "versions": [{"status": "unaffected", "version": "101"}], "defaultStatus": "unknown"}]}], "published": "2026-03-04T07:16:13.713", "references": [{"url": "https://www.abdulmhsblog.com/posts/sfx2100-vulns/", "tags": ["Exploit", "Third Party Advisory"], "source": "b7efe717-a805-47cf-8e9a-921fca0ce0ce"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "b7efe717-a805-47cf-8e9a-921fca0ce0ce", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "A path traversal vulnerability exists in the /IDC_Logging/checkifdone.cgi script in International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web management portal version 101. An authenticated attacker can manipulate the `file` parameter to traverse directories and enumerate arbitrary files on the underlying filesystem. Due to the insecure perl file path handling function in use, a authenticated actor is able to preform directory traversal, with the backup endpoint confirming a file exists by indicating that a backup operation was successful or when using the path of a non existent file, the returned status is failed."}, {"lang": "es", "value": "Una vulnerabilidad de salto de ruta existe en el script /IDC_Logging/checkifdone.cgi en el portal de gesti\u00f3n web del receptor de sat\u00e9lite SuperFlex de la serie SFX de International Datacasting Corporation (IDC) versi\u00f3n 101. Un atacante autenticado puede manipular el par\u00e1metro 'file' para recorrer directorios y enumerar archivos arbitrarios en el sistema de archivos subyacente. Debido a la funci\u00f3n insegura de manejo de rutas de archivos Perl en uso, un actor autenticado puede realizar un salto de directorio, con el endpoint de copia de seguridad confirmando que un archivo existe al indicar que una operaci\u00f3n de copia de seguridad fue exitosa o cuando se utiliza la ruta de un archivo no existente, el estado devuelto es fallido."}], "lastModified": "2026-06-17T10:29:00.490", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:datacast:sfx2100_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7C57B6A9-CAF9-4C8A-85FC-562E16F291FE"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:datacast:sfx2100:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "2A3BC5C9-39D5-4908-B470-A46E9ECFD6AB"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "b7efe717-a805-47cf-8e9a-921fca0ce0ce"}