The vulnerability is a reflected Cross‑Site Scripting flaw in the /IDC_Logging/index.cgi endpoint of the SFX Series SuperFlex SatelliteReceiver Web Management Interface. An unauthenticated remote attacker can inject arbitrary HTML or JavaScript by supplying a specially crafted value to the submitType parameter. When the parameter value is incorporated into the page without escaping, the attack can execute code in the context of the interface, enabling attackers to hijack user sessions, deface the UI, or perform phishing attacks against operators.

International Datacasting Corporation’s SFX Series SuperFlex SatelliteReceiver Web Management Interface version 101 is affected. Users running firmware versions corresponding to the SFX2100 series, as identified by the vendor’s cpe entries for the device and its firmware, are at risk.

The CVSS base score is 5.1, indicating a medium severity exposure. The EPSS score of less than 1% suggests that exploitation probability is low in the near term, and the vulnerability is not currently catalogued in CISA’s KEV list. However, because the attack vector is purely remote and requires only the ability to send requests to the web interface, a motivated actor could exploit it if the interface is exposed to the internet or an internal network without adequate segregation. The required conditions are minimal: generic HTTP request with a crafted submitType value; no authentication or privileged access is needed.