CVE-2026-28769— LFI in /IDC_Logging/checkifdone.cgi, "file" parameter Allowing for File Existence Enumeration On IDC Satellite Receiver Web Management Interface Version 101
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-28769
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
LFI in /IDC_Logging/checkifdone.cgi, "file" parameter Allowing for File Existence Enumeration On IDC Satellite Receiver Web Management Interface Version 101
Source: NVD (National Vulnerability Database)
Vulnerability Description
A path traversal vulnerability exists in the /IDC_Logging/checkifdone.cgi script in International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web management portal version 101. An authenticated attacker can manipulate the `file` parameter to traverse directories and enumerate arbitrary files on the underlying filesystem. Due to the insecure perl file path handling function in use, a authenticated actor is able to preform directory traversal, with the backup endpoint confirming a file exists by indicating that a backup operation was successful or when using the path of a non existent file, the returned status is failed.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: NVD (National Vulnerability Database)
Vulnerability Title
International Datacasting SFX Series SuperFlex Satellite Receiver Web management interface 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
International Datacasting SFX Series SuperFlex Satellite Receiver Web management interface是美国International Datacasting公司的一个卫星接收设备的Web管理后台。 International Datacasting SFX Series SuperFlex Satellite Receiver Web management interface 101版本存在安全漏洞，该漏洞源于对文件/IDC_
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| International Datacasting Corporation (IDC) | SFX Series SuperFlex Satellite Receiver Web management interface | 101 | - |
II. Public POCs for CVE-2026-28769
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-28769
请登录查看更多情报信息。
Same Patch Batch · International Datacasting Corporation (IDC) · 2026-03-04 · 11 CVEs total
| CVE-2026-28770 | XML injection In /IDC_Logging/checkifdone.cgi Endpoint On IDC SFX Web Management Interface | |
| CVE-2026-28772 | Reflected XSS in IDC_Logging Index endpoint | |
| CVE-2026-28774 | Authenticated OS Command Injection via Traceroute Utility leads to Root RCE | |
| CVE-2026-28771 | Reflected XSS In /index.cgi Endpoint On IDC Satellite Receiver Web Management Interface Ve | |
| CVE-2026-28773 | Authenticated OS Command Injection via Ping Utility Leading to RCE as Root | |
| CVE-2026-28775 | Unauthenticated RCE via SNMP Default Writable Community String | |
| CVE-2026-29119 | Hardcoded and Insecure Credentials for "Admin" Account providing Telnet Access on IDC SFX2 | |
| CVE-2026-28777 | Hardcoded and Insecure Credentials for "User" Local Account with SSH Access On IDC SFX2100 | |
| CVE-2026-28776 | Hardcoded and Insecure Credentials for "monitor" account with SSH Access On IDC SFX2100 Sa | |
| CVE-2026-28778 | Hardcoded FTP Credentials and LPE(via Insecure Permissions) for `xd` Local Account on IDC |
IV. Related Vulnerabilities
Same vendor: International Datacasting Corporation (IDC)
- CVE-2026-29119
Hardcoded and Insecure Credentials for "Admin" Account provi - CVE-2026-28778
Hardcoded FTP Credentials and LPE(via Insecure Permissions) - CVE-2026-28777
Hardcoded and Insecure Credentials for "User" Local Account - CVE-2026-28776
Hardcoded and Insecure Credentials for "monitor" account wit - CVE-2026-28775
Unauthenticated RCE via SNMP Default Writable Community Stri
Same weakness: CWE-22
- CVE-2026-8274
npitre cramfs-tools Directory cramfsck.c do_directory path t - CVE-2022-50956
WordPress Plugin amministrazione-aperta 3.7.3 Local File Rea - CVE-2026-8215
Industrial Application Software IAS Canias ERP RMI iasReques - CVE-2026-42605
AzuraCast: Path Traversal in `currentDirectory` Parameter En - CVE-2026-42574
apko dirFS has a symlink-following path traversal that allow
V. Comments for CVE-2026-28769
No comments yet