International Data Casting SFX2100 Satellite Receiver Multiple SUID Binaries Local Privilege Escalation Vulnerability

A local privilege escalation vulnerability has been identified in the International Data Casting (IDC) SFX2100 Satellite Receiver. This issue arises from multiple SUID root-owned binaries located in the 'monitor' user home directory. The vulnerability allows the 'monitor' user to escalate privileges to root.

Impact

Exploitation of this vulnerability allows the 'monitor' user to gain root privileges on the affected device.

Reproduction

The vulnerability can be reproduced by exploiting the insecure directory permissions on the 'monitor' user's home directory, which is world-writable. This allows for the modification of commands or symlinks that would be executed by the 'kore-terminal' or 'terminal' binaries, both of which are SUID and can be used to escalate privileges to root.