CVE-2026-28769 Details
Description
A path traversal vulnerability exists in the /IDC_Logging/checkifdone.cgi script in International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web management portal version 101. An authenticated attacker can manipulate the `file` parameter to traverse directories and enumerate arbitrary files on the underlying filesystem. Due to the insecure perl file path handling function in use, a authenticated actor is able to preform directory traversal, with the backup endpoint confirming a file exists by indicating that a backup operation was successful or when using the path of a non existent file, the returned status is failed.
A path traversal vulnerability has been identified in the International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web management portal, version 101. The vulnerability resides in the '/IDC_Logging/checkifdone.cgi' script, where an authenticated attacker can manipulate the 'file' parameter to traverse directories and enumerate arbitrary files on the underlying filesystem. This issue arises from insecure handling of file paths in Perl, allowing authenticated users to perform directory traversal. The vulnerability can be exploited by using a backup endpoint that confirms the existence of a file by indicating a successful backup operation, or by referencing a non-existent file, which results in a failed status.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.abdulmhsblog.com/posts/sfx2100-vulns/ | Gridware | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | Gridware |
Affected Products
| Product | Versions |
|---|---|
| datacast sfx2100 firmware | All versions |
CPE
Remediation
| |
| datacast sfx2100 | All versions |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | Gridware |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 9, 2026 | Initial Analysis | [email protected] |
| Mar 5, 2026 | CVE Modified | Gridware |
| Mar 4, 2026 | New CVE Received | Gridware |