CVE-2026-29122

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-29122
International Data Casting (IDC) SFX2100 satellite receiver comes with the `/bin/date` utility installed with the setuid bit set. This configuration grants elevated privileges to any local user who can execute the binary. A local actor is able to use the GTFObins resource to preform privileged file reads as the root user on the local file system. This allows an actor to be able to read any root read-only files, such as the /etc/shadow file or other configuration/secrets carrier files.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://gtfobins.org/gtfobins/date/ Exploit
https://www.abdulmhsblog.com/posts/sfx2100-vulns/ Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:datacast:sfx2100_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:datacast:sfx2100:-:*:*:*:*:*:*:*
History

11 Mar 2026, 18:35

Type Values Removed Values Added
CWE NVD-CWE-noinfo
CPE cpe:2.3:h:datacast:sfx2100:-:*:*:*:*:*:*:*
cpe:2.3:o:datacast:sfx2100_firmware:-:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
Summary
  • (es) El receptor de satélite International Data Casting (IDC) SFX2100 viene con la utilidad `/bin/date` instalada con el bit setuid establecido. Esta configuración otorga privilegios elevados a cualquier usuario local que pueda ejecutar el binario. Un actor local puede usar el recurso GTFObins para realizar lecturas de archivos privilegiadas como el usuario root en el sistema de archivos local. Esto permite a un actor poder leer cualquier archivo de solo lectura de root, como el archivo /etc /shadow u otros archivos que contienen configuración o secretos.
References () https://gtfobins.org/gtfobins/date/ - () https://gtfobins.org/gtfobins/date/ - Exploit
References () https://www.abdulmhsblog.com/posts/sfx2100-vulns/ - () https://www.abdulmhsblog.com/posts/sfx2100-vulns/ - Exploit, Third Party Advisory
First Time Datacast
Datacast sfx2100
Datacast sfx2100 Firmware

05 Mar 2026, 06:16

Type Values Removed Values Added
References
  • {'url': 'https://www.abdulmhsblog.com/posts/spfx-vulnrabilities/', 'source': 'b7efe717-a805-47cf-8e9a-921fca0ce0ce'}
  • () https://www.abdulmhsblog.com/posts/sfx2100-vulns/ -

05 Mar 2026, 02:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-05 02:16

Updated : 2026-03-11 18:35

NVD link : CVE-2026-29122

Mitre link : CVE-2026-29122

CVE.ORG link : CVE-2026-29122

JSON object : View

Products Affected

datacast

  • sfx2100
  • sfx2100_firmware
CWE
CWE-269

Improper Privilege Management

NVD-CWE-noinfo