Insecure Daemon Configuration in IDC SFX2100 Satellite Receiver Firmware

CVE-2026-29128

What is CVE-2026-29128?

The IDC SFX2100 Satellite Receiver firmware comes with several daemon configuration files set to world-readable permissions, leading to exposure of sensitive data. These files, including zebra.conf, bgpd.conf, ospfd.conf, and ripd.conf, contain hardcoded sensitive plaintext passwords, such as privileged-mode credentials. This vulnerability allows a remote attacker to exploit these insecure credentials to gain unauthorized access to other systems in the network. The potential for further intrusion into the satellite receiver or local privilege escalation raises significant security concerns.

References