Cyber Posture

CVE-2026-28773

HighPublic PoC

Published: 04 March 2026

Published
04 March 2026
Modified
09 March 2026
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0065 71.0th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

The web-based Ping diagnostic utility (/IDC_Ping/main.cgi) in International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web Management Interface version 101 is vulnerable to OS Command Injection. The application insecurely parses the `IPaddr` parameter. An authenticated attacker can bypass server-side…

more

semicolon exclusion checks by using alternate shell metacharacters (such as the pipe `|` operator) to append and execute arbitrary shell commands with root privileges.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly requires validation of the IPaddr parameter to reject malformed inputs with shell metacharacters like pipe |, preventing OS command injection.

SI-2 Flaw Remediation good match
prevent

Mandates timely identification, reporting, and remediation of flaws such as the insecure parsing in /IDC_Ping/main.cgi, eliminating the vulnerability through patching.

CM-7 Least Functionality good match
prevent

Enforces least functionality by prohibiting or restricting unnecessary diagnostic utilities like the vulnerable Ping tool, blocking the attack vector entirely.

Security SummaryAI

CVE-2026-28773 is an OS Command Injection vulnerability (CWE-78) affecting the web-based Ping diagnostic utility at /IDC_Ping/main.cgi in the International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web Management Interface version 101. The issue arises from insecure parsing of the IPaddr parameter, with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Published on 2026-03-04, it allows attackers to bypass server-side semicolon exclusion checks.

An authenticated attacker with low privileges (PR:L) can exploit this vulnerability remotely over the network (AV:N) with low attack complexity (AC:L) and no user interaction required. By using alternate shell metacharacters, such as the pipe (|) operator, the attacker can append and execute arbitrary shell commands with root privileges, potentially compromising confidentiality, integrity, and availability at a high level.

Advisories and mitigation details are available in the referenced blog post at https://www.abdulmhsblog.com/posts/sfx2100-vulns/.

Details

CWE(s)
CWE-78

Affected Products

datacast
sfx2100 firmware
all versions

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

CVE enables OS command injection via web CGI parameter (T1190: Exploit Public-Facing Application), allowing arbitrary Unix shell command execution (T1059.004) with privilege escalation to root (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References