A hardcoded credential for the local "user" account allows an attacker to connect via SSH without authentication. The attacker initially enters a restricted shell, but can spawn a full pseudo‑terminal to gain an interactive shell, effectively permitting remote code execution on the device.

International Datacasting Corporation SFX2100 Satellite Receiver. No specific firmware versions are listed; all models of the SFX2100 are potentially vulnerable.

The vulnerability scores a CVSS of 9.2, indicating critical impact. EPSS is < 1%, suggesting a low current exploitation probability, and the issue is not yet listed in CISA's Known Exploited Vulnerabilities catalog. The likely attack vector is a network‑based attempt to SSH into the device using the default credentials discovered in the firmware. If exploited, an attacker could take full control of the receiver.