Internally hardcoded credentials for the 'admin' account allow a remote, unauthenticated attacker to connect via the Telnet service, directly accessing the SFX2100 Satellite Receiver. The flaw provides full control of the device, raising the potential for configuration changes, data exfiltration, or service disruption. The CVSS score of 8.8 highlights this as a high‑severity weakness, classified as CWE‑798 – insecure default or hardcoded credentials.

The vulnerability targets the International Datacasting Corporation SFX2100 Series SuperFlex Satellite Receiver. No specific firmware revisions are listed, so all models carrying the default telnet credentials are considered affected.

Despite a very low EPSS (<1%) and absence from the CISA KEV catalog, the flaw remains exploitable over the open Telnet port. The likely attack vector is a remote Telnet connection using the undocumented admin credentials, which does not require prior authentication or privileged access. The high CVSS score indicates significant impact should exploitation occur. Monitoring for unauthorized telnet sessions is advisable until a vendor patch can be applied.