CVE-2026-28775: Unauthenticated RCE via SNMP Default Writable Community String
An unauthenticated Remote Code Execution (RCE) vulnerability exists in the SNMP service of International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver. The deployment insecurely provisions the private SNMP community string with read/write access by default. Because the SNMP agent runs as root, an unauthenticated remote attacker can utilize NET-SNMP-EXTEND-MIB directives, abusing the fact that the system runs a vulnerable version of net-snmp pre 5.8, to execute arbitrary operating system commands with root privileges.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28775?
CVE-2026-28775 is classified as a critical severity vulnerability due to its potential for unauthenticated remote code execution.
How do I fix CVE-2026-28775?
To fix CVE-2026-28775, ensure that the SNMP community strings are properly secured and not set to default values.
What products are affected by CVE-2026-28775?
CVE-2026-28775 affects the International Datacasting Corporation SFX Series SuperFlex SatelliteReceiver and Net-SNMP versions prior to 5.8.
What kind of attack is facilitated by CVE-2026-28775?
CVE-2026-28775 facilitates unauthenticated remote code execution attacks via insecure SNMP community string configurations.
Are there any known exploits for CVE-2026-28775?
Yes, there are known exploits for CVE-2026-28775 that take advantage of the default writable community strings to execute arbitrary code.