CVE-2026-28771 — Reflected XSS In /index.cgi Endpoint On IDC Satellite Receiver Web Management Interface Version 101
A Reflected Cross-Site Scripting (XSS) vulnerability exists in the /index.cgi endpoint of International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web…
Published: 2026-03-04 · CVSS: 5.1 · CVSS 4.0
A Reflected Cross-Site Scripting (XSS) vulnerability exists in the /index.cgi endpoint of International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web Management Interface version 101. The application fails to adequately sanitize user-supplied input provided via the `cat` parameter before reflecting it in the HTTP response, allowing a remote attacker to execute arbitrary HTML or JavaScript in the victim's browser context.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7