International Datacasting IDC SFX2100 SuperFlex Satellite Receiver default.script permission assignment

Summaryinfo

A vulnerability classified as critical has been found in International Datacasting IDC SFX2100 SuperFlex Satellite Receiver. The affected element is an unknown function of the file /etc/udhcpc/default.script. The manipulation leads to permission assignment. This vulnerability is listed as CVE-2026-29126. The attack must be carried out locally. There is no available exploit.

Detailsinfo

A vulnerability was found in International Datacasting IDC SFX2100 SuperFlex Satellite Receiver (version now known). It has been rated as critical. This issue affects some unknown processing of the file /etc/udhcpc/default.script. The manipulation with an unknown input leads to a permission assignment vulnerability. Using CWE to declare the problem leads to CWE-732. The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Incorrect permission assignment (world-writable file) in /etc/udhcpc/default.script in International Data Casting (IDC) SFX2100 Satellite Receiver allows a local unprivileged attacker to potentially execute arbitrary commands with root privileges (local privilege escalation and persistence) via modification of a root-owned, world-writable BusyBox udhcpc DHCP event script, which is executed when a DHCP lease is obtained, renewed, or lost.

The weakness was presented by Abdul Mhanni. The advisory is shared at abdulmhsblog.com. The identification of this vulnerability is CVE-2026-29126 since 03/04/2026. The exploitation is known to be easy. An attack has to be approached locally. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 03/11/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• International Datacasting

Name

• IDC SFX2100 SuperFlex Satellite Receiver

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion