CVE-2026-28774 — Authenticated OS Command Injection via Traceroute Utility leads to Root RCE
An OS Command Injection vulnerability exists in the web-based Traceroute diagnostic utility of International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver…
Published: 2026-03-04 · CVSS: 9.3 · CVSS 4.0
An OS Command Injection vulnerability exists in the web-based Traceroute diagnostic utility of International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver Web Management Interface version 101. An authenticated attacker can inject arbitrary shell metacharacters (such as the pipe `|` operator) into the flags parameter, leading to the execution of arbitrary operating system commands with root privileges.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7