International Datacasting Corporation SuperFlex Satellite Receiver Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in the International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web Management Interface, version 101. The issue arises in the /index.cgi endpoint, where the application inadequately sanitizes user input supplied through the 'cat' parameter. This lack of proper input validation allows remote attackers to execute arbitrary HTML or JavaScript in the context of the victim's browser.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.