The SFX2100 firmware contains configuration files for routing daemons that are owned by root but world‑readable. These files embed hard‑coded plaintext passwords, including privileged‑mode credentials. This flaw represents information exposure through hard‑coded credentials (CWE-522) and the use of hard‑coded passwords (CWE-798). An attacker who can read the files gains valid authentication tokens that can be used to elevate privileges on the satellite receiver or to access other networked devices, thereby jeopardizing confidentiality, integrity, and availability.

International Datacasting Corporation’s SFX2100 Satellite Receiver. All firmware builds that ship the vulnerable routing daemon configuration files are affected; specific firmware identifiers are not listed in the advisory.

The CVSS score of 8.6 classifies this vulnerability as high severity. The EPSS score of less than 1% indicates low current exploitation probability, but the required condition—read access to a file—is a common misconfiguration. The vulnerability is not listed in CISA’s KEV catalog. Because the exploit requires only local or remote read access to the filesystem, the attack vector is likely through a management interface or an exposed admin account. Once the credentials are retrieved, the attacker can authenticate as a privileged user and potentially pivot to other infrastructure devices.