The web-based Ping diagnostic utility (/IDC_Ping/main.cgi) in the International Datacasting Corporation SFX Series SuperFlex Satellite Receiver Web Management Interface of version 101 is vulnerable to OS Command Injection. Insecure parsing of the IPaddr parameter allows an authenticated attacker to bypass server‑side semicolon exclusion checks by using alternate shell metacharacters such as the pipe operator, enabling the execution of arbitrary shell commands with root privileges. This flaw gives a qualified attacker full control over the device, threatening confidentiality, integrity, and availability.

Affected systems are the International Datacasting Corporation SFX Series SuperFlex Satellite Receiver Web Management Interface, specifically version 101. The vulnerability resides in the Ping diagnostic utility of the SFX2100 model, as identified by the corresponding hardware and firmware CPE entries.

The flaw carries a CVSS base score of 9.3, indicating critical severity, and a very low EPSS probability (<1%), suggesting that widespread exploitation is unlikely at present. It is not listed in the CISA KEV catalogue. The attack requires authenticated access to the web interface, making it a local or network‑limited threat that can be mitigated by restricting privileged access. Nevertheless, the high severity and root‑level command execution ability make immediate attention essential.