CVE-2026-29121: `/sbin/ip` Binary given SETUID Permissions on IDC SFX2100 Leading to Potential LPE
International Data Casting (IDC) SFX2100 satellite receiver comes with the /sbin/ip utility installed with the setuid bit set. This configuration grants elevated privileges to any local user who can execute the binary. A local actor is able to use the GTFObins resource to preform privileged file reads as the root user on the local file system and may potentially lead to other avenues for preforming privileged actions.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-29121?
The severity of CVE-2026-29121 is considered high due to the potential for local privilege escalation.
How do I fix CVE-2026-29121?
To fix CVE-2026-29121, remove the setuid bit from the `/sbin/ip` binary to prevent unauthorized privilege escalation.
Who is affected by CVE-2026-29121?
CVE-2026-29121 affects users of the International Data Casting SFX2100 satellite receiver due to the setuid configuration of `/sbin/ip`.
Can CVE-2026-29121 be exploited remotely?
CVE-2026-29121 cannot be exploited remotely; it requires local access to the affected system.
What does the setuid bit do in the context of CVE-2026-29121?
In the context of CVE-2026-29121, the setuid bit allows any user to execute the `/sbin/ip` utility with the elevated permissions of the file owner.