Path Traversal Vulnerability in International Datacasting SFX Series Receiver

CVE-2026-28769

What is CVE-2026-28769?

A path traversal vulnerability exists in the web management portal of the International Datacasting Corporation SFX Series SuperFlex Satellite Receiver version 101. An authenticated attacker can exploit this vulnerability by manipulating the file parameter within the /IDC_Logging/checkifdone.cgi script. This allows the attacker to traverse directory structures and enumerate arbitrary files on the system's filesystem. The issue arises from the insecure handling of file paths in Perl, enabling attackers to confirm the existence of files by observing the responses from backup operations, depending on the existence of the specified file or directory.

References