International Datacasting Corporation’s SFX2100 SuperFlex Satellite Receiver ships with undocumented, hard‑coded credentials for a local xd account. An attacker can log in to the receiver’s FTP service without any prior authentication, and because the xd user has write permission to its home directory, the attacker may overwrite binaries or manipulate symbolic links that are executed with root privileges. This gives the attacker the ability to run arbitrary code as root, compromising the entire device.

The vulnerability affects the International Datacasting Corporation SFX2100 SuperFlex Satellite Receiver. Specific product model is the SFX2100; no version information is supplied to indicate the extent of the affected firmware revisions.

The CVSS score of 7.9 places the issue in the high‑severity range, while the EPSS score of less than 1% suggests that exploitation is unlikely at present. The vulnerability is not yet listed in the CISA KEV catalog. The likely attack vector is a remote unauthenticated FTP session, whereby the attacker can replace root‑executed binaries or alter symlinks to achieve privilege escalation to root.