International Datacasting SuperFlex Satellite Receiver OS Command Injection Vulnerability

A command injection vulnerability has been identified in the web-based Ping diagnostic utility of the International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web Management Interface, version 101. The vulnerability arises because the application improperly sanitizes the 'IPaddr' parameter, allowing authenticated attackers to circumvent server-side restrictions on semicolons. By using alternative shell metacharacters, such as the pipe operator, attackers can append and execute arbitrary shell commands with root privileges.

Impact

Exploitation of this vulnerability allows for unauthorized execution of shell commands with root privileges on the affected system.