CVE-2026-28771: Reflected XSS In /index.cgi Endpoint On IDC Satellite Receiver Web Management Interface Version 101
A Reflected Cross-Site Scripting (XSS) vulnerability exists in the /index.cgi endpoint of International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web Management Interface version 101. The application fails to adequately sanitize user-supplied input provided via the cat parameter before reflecting it in the HTTP response, allowing a remote attacker to execute arbitrary HTML or JavaScript in the victim's browser context.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28771?
The severity of CVE-2026-28771 is classified as medium, due to its potential for reflected cross-site scripting (XSS) attacks.
How do I fix CVE-2026-28771?
To fix CVE-2026-28771, update the International Datacasting Corporation SFX Series SuperFlex Satellite Receiver Web Management Interface to the latest version provided by the vendor.
What are the potential impacts of CVE-2026-28771?
The potential impacts of CVE-2026-28771 include unauthorized access and manipulation of the web interface, which could lead to data theft or compromise.
Which software is affected by CVE-2026-28771?
CVE-2026-28771 affects the International Datacasting Corporation SFX Series SuperFlex Satellite Receiver Web Management Interface, version 101.
How can I mitigate the risks of CVE-2026-28771 if I cannot update?
If you cannot update, mitigate the risks of CVE-2026-28771 by implementing strict input validation and output encoding in your web application to prevent XSS.