A Reflected Cross‑Site Scripting flaw exists in the /index.cgi endpoint of the IDC SFX Series SuperFlex Satellite Receiver Web Management Interface, version 101. The application does not adequately sanitize the user‑supplied cat parameter before reflecting it in the HTTP response, enabling an attacker to inject arbitrary HTML or JavaScript that runs in a victim’s browser. This can lead to session hijacking, malicious data disclosure, or additional client‑side attacks within the context of the authenticated user, and is classified as CWE‑79 where improper output encoding is used.

International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web Management Interface, specifically firmware version 101. Devices running this firmware are vulnerable; no other products or versions are listed as affected.

The CVSS score is 5.1, indicating moderate severity, while the EPSS score is below 1%, indicating very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation is remote and requires only access to the web endpoint; an attacker can craft a URL with a malicious cat value and lure a victim to visit it. The impact is confined to the victim’s browser session, but if the interface has elevated privileges or integrated authentication it could have broader consequences. Exposure of the interface to the public Internet raises the risk; internal or firewall‑protected access reduces the likelihood.