CVE-2026-28778

CVE-2026-28778 describes a critical vulnerability in International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receivers, stemming from undocumented, hardcoded credentials for the 'xd' user account. A remote, unauthenticated attacker can exploit this via FTP to gain write access to the 'xd' user's home directory. This allows for overwriting root-executed binaries or manipulating symlinks, leading to arbitrary code execution as the root user. With a CVSS score of 7.9 (HIGH), this vulnerability presents a significant risk due to its network-based attack vector, low attack complexity, and complete compromise of confidentiality, integrity, and availability. There is currently no public exploit code available, nor is there evidence of active exploitation or significant community discussion surrounding this CVE.