How to Fix CVE-2026-28773: SFX Series SuperFlex SatelliteReceiver Web Management Interface (Bundle Sibling)
By Sai Kiran Pandrala. Last verified: 2026-05-25.
CVE-2026-28773 is a sibling vulnerability in the same vendor advisory as CVE-2026-28769. Apply the same patched build and you close both. The technical detail below is what differs.
| Severity | 9.3 (Critical) |
|---|---|
| Actively exploited? | No public listing in CISA KEV |
| Affected | SFX Series SuperFlex SatelliteReceiver Web Management Interface 101 |
| Fixed in | Same patched build as CVE-2026-28769 |
| Type (CWE) | CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') |
What's different about CVE-2026-28773?
The web-based Ping diagnostic utility (/IDC_Ping/main.cgi) in International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web Management Interface version 101 is vulnerable to OS Command Injection. The application insecurely parses the IPaddr parameter. An authenticated attacker can bypass server-side semicolon exclusion checks by using alternate shell metacharacters (such as the pipe | operator) to append and execute arbitrary shell commands with root privileges.
How to fix CVE-2026-28773
Apply the patched build per the primary write-up: How to Fix CVE-2026-28769. All commands, verification steps, and rollback notes for SFX Series SuperFlex SatelliteReceiver Web Management Interface are listed there.
Frequently asked questions
Does the CVE-2026-28769 patch close CVE-2026-28773?
Yes. Both CVEs are addressed by the same vendor patch. Applying the patched build closes the full bundle.
Is CVE-2026-28773 listed in CISA KEV?
No public KEV listing at the time of this writing.
Where is the official advisory?
See https://www.abdulmhsblog.com/posts/sfx2100-vulns/
References
- Official vendor advisory: https://www.abdulmhsblog.com/posts/sfx2100-vulns/
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-28773
- CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- Primary: How to Fix CVE-2026-28769
*Written by Sai Kiran Pandrala. Part of the SFX Series SuperFlex SatelliteReceiver Web Management Interface bundle. Full procedure at how-to-fix-cve-2026-28769.*