Insecure Password Storage in International Datacasting SFX Series SuperFlex Satellite Receiver

CVE-2026-29120

What is CVE-2026-29120?

The SFX2100 SuperFlex Satellite Receiver by International Datacasting Corporation contains a significant vulnerability whereby the installation configuration file (anaconda-ks.cfg) stores a hardcoded root password hash in an insecure manner. This weak password is at risk of brute-force attacks, particularly utilizing common wordlists, such as rockyou.txt. While direct root SSH login is disabled, an attacker must first gain low-privileged access to the system through other means. If successful, they can escalate their privileges to root, thereby compromising the entire system security.

References