International Datacasting Corporation SFX Series SuperFlex Satellite Receiver SNMP Service Unauthenticated Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in the SNMP service of International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receivers. This vulnerability arises because the deployment insecurely provisions the 'private' SNMP community string with read/write access by default. The SNMP agent operates with root privileges, allowing an unauthenticated remote attacker to execute arbitrary operating system commands as root. This exploitation takes advantage of 'NET-SNMP-EXTEND-MIB' directives and the presence of a vulnerable net-snmp version prior to 5.8.

Impact

Exploitation of this vulnerability allows for unauthenticated remote code execution with root privileges on the affected system.