International Datacasting SFX Series SuperFlex Satellite Receiver Hardcoded Root Password Hash Vulnerability

A vulnerability exists in the International Datacasting Corporation (IDC) SFX Series (SFX2100) SuperFlex Satellite Receiver due to the /root/anaconda-ks.cfg installation configuration file insecurely storing the hardcoded root password hash. This password is weak and can be cracked using offline dictionary attacks with the rockyou.txt wordlist. Although direct root SSH access is disabled, an attacker must first gain low-privileged access to the system through other vulnerabilities to log in as the root user. Once access is obtained, the hardcoded password allows for escalation to root privileges.

Impact

Exploitation of this vulnerability could lead to unauthorized root access on the affected system.