The vulnerability arises because the SNMP agent on the SFX2100 Series SuperFlex SatelliteReceiver is configured with a writable community string named "private" by default. The SNMP daemon runs as root and uses a net‑snmp version prior to 5.8 that accepts NET‑SNMP‑EXTEND‑MIB commands. An attacker who can reach the SNMP port can send an extend command that causes the daemon to execute arbitrary operating system commands with root privileges, giving the attacker full control of the device. The impact is a complete compromise of confidentiality, integrity, and availability.

International Datacasting Corporation’s SFX2100 Series SuperFlex SatelliteReceiver (both hardware and firmware) are affected. No specific firmware revisions are listed, so all current releases that run the default SNMP configuration are at risk.

The CVSS score of 10 indicates maximum severity. The exploit probability is reported as less than one percent, suggesting the vulnerable configuration is uncommon or not widely exploited yet, but the absence from a known exploited vulnerability catalog does not diminish the risk for a network that can reach the device. The likely attack vector is remote SNMP over the network; no authentication or complex prerequisites are required beyond network connectivity to the SNMP service. If exploitation occurs, the attacker would gain root privileges and could execute any command, set up persistence, or tamper with satellite reception functions.