The vulnerability arises because the IDC SFX2100 SuperFlex Satellite Receiver contains hardcoded credentials for the privileged "monitor" account. A remote attacker can exploit these undocumented credentials without any authentication to open an SSH session. Although the initial shell is restricted, the attacker can escape to a full command-line environment, allowing arbitrary command execution with the monitor account's privileges.

International Datacasting Corporation’s SFX2100 SuperFlex Satellite Receiver is affected. Any firmware version that includes the hardcoded monitor account credentials is vulnerable; the CVE does not list specific firmware revisions, so all current releases are potentially impacted.

The CVSS score of 7.8 indicates high severity, while the EPSS score of less than 1% points to a low likelihood of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation yet. The attack vector is remote, unauthenticated, and trivially exploitable once the device’s SSH port is reachable, making it a significant threat for operators relying on default credentials.