An OS Command Injection flaw exists in the web‑based Traceroute diagnostic utility of International Datacasting Corporation’s SFX Series SuperFlex SatelliteReceiver Web Management Interface. An authenticated attacker can inject shell metacharacters into the flags parameter, causing arbitrary operating system commands to run with root privileges. The flaw is a classic CWE‑78 vulnerability that allows full control over the device’s operating system.

The vulnerability affects International Datacasting Corporation’s SFX Series SuperFlex SatelliteReceiver Web Management Interface, version 101, which runs on the SFX 2100 hardware platform. Users of this specific firmware version are exposed to the risk.

The CVSS score of 9.3 indicates a critical severity, and while the EPSS score is below 1 % indicating a low probability of widespread exploitation, the issue is not listed in the CISA KEV catalog. Attacker must first authenticate to the web management interface, a privilege usually granted to administrators. Once logged in, the attacker can supply malicious input to the traceroute endpoint and execute arbitrary commands with system privileges.