International Datacasting SuperFlex Satellite Receiver OS Command Injection Vulnerability

A command injection vulnerability has been identified in the web-based Traceroute utility of the International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web Management Interface, version 101. This vulnerability allows authenticated attackers to inject arbitrary shell metacharacters, such as the pipe operator, into the flags parameter. Exploitation of this vulnerability could lead to the execution of arbitrary operating system commands with root privileges.

Impact

Exploitation of this vulnerability allows for arbitrary operating system command execution with root privileges.