CVE-2026-28773: Authenticated OS Command Injection via Ping Utility Leading to RCE as Root
The web-based Ping diagnostic utility (/IDCPing/main.cgi) in International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web Management Interface version 101 is vulnerable to OS Command Injection. The application insecurely parses the IPaddr parameter. An authenticated attacker can bypass server-side semicolon exclusion checks by using alternate shell metacharacters (such as the pipe | operator) to append and execute arbitrary shell commands with root privileges.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28773?
CVE-2026-28773 is classified with a high severity due to its potential for remote code execution.
How do I fix CVE-2026-28773?
To fix CVE-2026-28773, update the International Datacasting Corporation SFX Series SuperFlex SatelliteReceiver Web Management Interface to a patched version.
What is the impact of CVE-2026-28773?
The impact of CVE-2026-28773 includes unauthorized remote access leading to root-level command execution on the affected system.
Which software versions are affected by CVE-2026-28773?
CVE-2026-28773 affects the International Datacasting Corporation SFX Series SuperFlex SatelliteReceiver Web Management Interface version 101.
Who is the vendor for CVE-2026-28773?
The vendor for CVE-2026-28773 is International Datacasting Corporation.