XML Injection Flaw in IDC SFX Series Satellite Receiver Web Management Interface

CVE-2026-28770

What is CVE-2026-28770?

The vulnerability in the web management interface of the IDC SFX Series SuperFlex Satellite Receiver allows for improper neutralization of special elements, specifically in the /IDC_Logging/checkifdone.cgi script. An authenticated attacker can exploit this flaw by injecting malicious XML content through the un-sanitized file parameter, which is reflected directly into a CDATA block. This leads not only to potential reflected XSS attacks but may also facilitate further exploitation such as XML External Entity (XXE) attacks, posing significant risks to the integrity and security of the affected system.

References