CVE-2026-29126: fallo de gravedad alta en International Datacasting Corporation SFX2100…
World-Writable, Root Owned/Run `/etc/udhcpc/default.script` in IDC SFX2100 Satellite Receiver Leads To Potential LPE
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.5epss 0.2%
Incorrect permission assignment (world-writable file) in /etc/udhcpc/default.script in International Data Casting (IDC) SFX2100 Satellite Receiver allows a local unprivileged attacker to potentially execute arbitrary commands with root privileges (local privilege escalation and persistence) via modification of a root-owned, world-writable BusyBox udhcpc DHCP event script, which is executed when a DHCP lease is obtained, renewed, or lost.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:H/SI:H/SA:H/AU:N/R:U
Productos afectados
International Datacasting Corporation · SFX2100 Satellite ReceiverCVEs relacionadas — International Datacasting Corporation SFX2100…
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-29128HIGHIDC SFX2100 Satellite Receiver bgpd/ospfd/ripd/zebra Config Credential Disclosure via World-Readable FilesEPSS 0.3%CVE-2026-29127CRITICALIncorrect Permission Assignment(777) on `monitor` Users Home Directory Containing SUID Root Binaries in IDC SFX2100EPSS 0.2%CVE-2026-29121HIGH`/sbin/ip` Binary given SETUID Permissions on IDC SFX2100 Leading to Potential LPEEPSS 0.2%CVE-2026-29122HIGH`/bin/date` Binary given SETUID Permissions on IDC SFX2100 Leading to Potential LPEEPSS 0.2%CVE-2026-29123HIGHMultiple SUID Root Binaries in `xd` User Home Directory Leading to Potential Local Privilege EscalationEPSS 0.1%CVE-2026-29124HIGHMultiple SUID Root Binaries in `monitor` User Home Directory Leading to Potential Local Privilege EscalationEPSS 0.1%