International Datacasting Corporation SuperFlex Satellite Receiver Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in the International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web Management Interface version 101. The issue resides in the /IDC_Logging/index.cgi endpoint, where a remote attacker can execute arbitrary web scripts or HTML. This vulnerability is triggered by sending a crafted payload through the submitType parameter, which is reflected directly into the DOM without proper escaping.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.