International Datacasting IDC SFX2100 SuperFlex Satellite Receiver /root/anaconda-ks.cfg hard-coded credentials

Summaryinfo

A vulnerability, which was classified as critical, has been found in International Datacasting IDC SFX2100 SuperFlex Satellite Receiver SFX2100. Affected is an unknown function of the file /root/anaconda-ks.cfg. Performing a manipulation results in hard-coded credentials. This vulnerability is cataloged as CVE-2026-29120. The attack must be initiated from a local position. There is no exploit available.

Detailsinfo

A vulnerability, which was classified as critical, was found in International Datacasting IDC SFX2100 SuperFlex Satellite Receiver SFX2100. This affects an unknown functionality of the file /root/anaconda-ks.cfg. The manipulation with an unknown input leads to a hard-coded credentials vulnerability. CWE is classifying the issue as CWE-798. The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

The /root/anaconda-ks.cfg installation configuration file in International Datacasting Corporation (IDC) SFX Series(SFX2100) SuperFlex Satellite Receiver insecurely stores the hardcoded root password hash. The password itself is highly insecure and susceptible to offline dictionary attacks using the rockyou.txt wordlist. Because direct root SSH login is disabled, an attacker must first obtain low-privileged access to the system (e.g., via other vulnerabilities) to be able to log in as the root user. The password is hardcoded and so allows for an actor with local access on effected versions to escalate to root

The weakness was shared by Abdul Mhanni. It is possible to read the advisory at abdulmhsblog.com. This vulnerability is uniquely identified as CVE-2026-29120 since 03/04/2026. The exploitability is told to be easy. Attacking locally is a requirement. Additional levels of successful authentication are needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1110.001 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• International Datacasting

Name

• IDC SFX2100 SuperFlex Satellite Receiver

Version

• SFX2100

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion