CVE-2026-29126

HIGH

7.8

Descripcion

Incorrect permission assignment (world-writable file) in /etc/udhcpc/default.script in International Data Casting (IDC) SFX2100 Satellite Receiver allows a local unprivileged attacker to potentially execute arbitrary commands with root privileges (local privilege escalation and persistence) via modification of a root-owned, world-writable BusyBox udhcpc DHCP event script, which is executed when a DHCP lease is obtained, renewed, or lost.

Detalles CVE

Puntuacion CVSS v3.17.8

SeveridadHIGH

Vector CVSSCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vector de ataqueLOCAL

ComplejidadLOW

Privilegios requeridosLOW

Interaccion usuarioNONE

Publicado3/5/2026

Ultima modificacion3/11/2026

Fuentenvd

Avistamientos honeypot0

Productos afectados

datacast:sfx2100datacast:sfx2100_firmware

Debilidades (CWE)

CWE-732CWE-863

Referencias

https://www.abdulmhsblog.com/posts/sfx2100-vulns/(b7efe717-a805-47cf-8e9a-921fca0ce0ce)

https://www.abdulmhsblog.com/posts/sfx2100-vulns/(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.