CVE-2026-29122 in SFX2100 Satellite Receiver
Summary
by MITRE • 03/05/2026
International Data Casting (IDC) SFX2100 satellite receiver comes with the `/bin/date` utility installed with the setuid bit set. This configuration grants elevated privileges to any local user who can execute the binary. A local actor is able to use the GTFObins resource to preform privileged file reads as the root user on the local file system. This allows an actor to be able to read any root read-only files, such as the /etc/shadow file or other configuration/secrets carrier files.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 03/11/2026
The CVE-2026-29122 vulnerability resides within the International Data Casting SFX2100 satellite receiver device, specifically targeting the `/bin/date` utility that is installed with the setuid bit enabled. This configuration represents a critical privilege escalation flaw that fundamentally undermines the security model of the device. The setuid bit, when improperly configured on system utilities, creates a pathway for local users to execute code with elevated privileges typically reserved for the root user. In this case, the vulnerability manifests through the device's implementation of the date utility, which should normally only perform time-related operations but instead provides unauthorized access to privileged file system operations. The configuration violates fundamental security principles by granting unnecessary elevated privileges to a utility that should operate with minimal permissions.
The technical exploitation of this vulnerability leverages the GTFObins resource, which catalogs binaries that can be abused to bypass local security restrictions. GTFObins serves as a comprehensive repository of such utilities that can be weaponized by attackers to perform privileged operations without requiring additional tools or complex exploitation techniques. The local actor can utilize this specific configuration to perform privileged file reads, effectively allowing them to access files that should normally be restricted to root-level access. This particular flaw enables the execution of read operations against sensitive system files including /etc/shadow, which contains hashed passwords for all user accounts, along with other configuration files and secret carrier files that may contain authentication tokens, cryptographic keys, or other sensitive information. The vulnerability creates a direct path from local user execution to root-level file access through the compromised setuid binary.
The operational impact of this vulnerability extends beyond simple privilege escalation, creating a comprehensive attack vector that can compromise the entire system integrity. An attacker who gains local access to the SFX2100 device can systematically enumerate and extract sensitive data from the system, potentially leading to complete system compromise. The ability to read /etc/shadow directly enables password cracking attacks, while access to other configuration files may reveal system architecture, network configurations, or service credentials. This vulnerability effectively transforms a local user account into a root-level entity with unrestricted access to critical system files, making it particularly dangerous for networked devices that may serve as entry points to larger network infrastructures. The impact is amplified when considering that satellite receivers often operate in environments where physical access is limited but network access may be available, creating multiple potential attack vectors.
Mitigation strategies for CVE-2026-29122 must address the fundamental misconfiguration that enables the privilege escalation. The primary recommendation involves removing the setuid bit from the `/bin/date` utility or ensuring that the binary properly validates its arguments and does not permit unauthorized access to system resources. System administrators should conduct comprehensive audits of all setuid binaries on the device to identify similar misconfigurations that may exist. The vulnerability aligns with CWE-276, which addresses improper privilege management, and represents a clear violation of the principle of least privilege that should be applied to all system utilities. Organizations should also implement regular security scanning procedures to detect unauthorized setuid configurations and maintain updated threat intelligence to identify potential exploitation attempts. Additionally, network segmentation and access controls should be implemented to limit the attack surface, while monitoring systems should be configured to detect unauthorized file access attempts that may indicate exploitation of this vulnerability. The remediation process should include comprehensive testing to ensure that legitimate system functionality remains intact while eliminating the security risk presented by the compromised setuid binary.