Unauthenticated RCE via SNMP Default Writable Community String

A satellite receiver device comes with a default SNMP password that allows anyone on the network to run commands as the administrator. An attacker can exploit this to take complete control of the device without needing any credentials.

An unauthenticated remote attacker can exploit a default writable SNMP community string ('private') on IDC SFX Series SuperFlex devices running vulnerable net-snmp versions prior to 5.8. By abusing NET-SNMP-EXTEND-MIB directives, the attacker can execute arbitrary OS commands with root privileges, as the SNMP agent runs with elevated permissions. No authentication or special conditions are required; network access to the SNMP service is sufficient.