The vulnerability stems from an incorrectly permissioned file, /etc/udhcpc/default.script, on the International Datacasting Corporation SFX2100 Satellite Receiver. The script is both root‑owned and world‑writable, allowing a local unprivileged user to modify it with arbitrary content. When a DHCP lease event occurs, the altered script is executed with root privileges, enabling the attacker to run arbitrary commands and achieve local privilege escalation and persistence. This is a classic permission error (CWE‑732) compounded by a design flaw in a privileged component (CWE‑863).

The vulnerability affects the International Datacasting Corporation SFX2100 Satellite Receiver device. No specific firmware or software version is listed, so any installation that runs the default udhcpc script is potentially impacted.

The CVSS score of 8.5 rates the vulnerability as high severity, while the EPSS score is below 1 %, indicating a low expected exploitation frequency. The CVE is not listed in the CISA KEV catalog. The flaw is a local one, requiring the attacker to have physical or network access to the device to modify files and trigger DHCP lease events. Once successful, the compromise escalates to root level, granting full control over the device.