High severity7.8NVD Advisory· Published Mar 5, 2026· Updated Jun 17, 2026
CVE-2026-29126
CVE-2026-29126
Description
Incorrect permission assignment (world-writable file) in /etc/udhcpc/default.script in International Data Casting (IDC) SFX2100 Satellite Receiver allows a local unprivileged attacker to potentially execute arbitrary commands with root privileges (local privilege escalation and persistence) via modification of a root-owned, world-writable BusyBox udhcpc DHCP event script, which is executed when a DHCP lease is obtained, renewed, or lost.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- cpe:2.3:o:datacast:sfx2100_firmware:-:*:*:*:*:*:*:*
(expand)+ 1 more
- (no CPE)
- (no CPE)range: SFX2100
Patches
Vulnerability mechanics
References
1- www.abdulmhsblog.com/posts/sfx2100-vulns/nvdExploitThird Party Advisory
News mentions
0No linked articles in our index yet.