CVE-2026-29121 PUBLISHED

`/sbin/ip` Binary given SETUID Permissions on IDC SFX2100 Leading to Potential LPE

Assigner: Gridware
Reserved: 04.03.2026 Published: 05.03.2026 Updated: 05.03.2026

International Data Casting (IDC) SFX2100 satellite receiver comes with the /sbin/ip utility installed with the setuid bit set. This configuration grants elevated privileges to any local user who can execute the binary. A local actor is able to use the GTFObins resource to preform privileged file reads as the root user on the local file system and may potentially lead to other avenues for preforming privileged actions.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:P/RE:L/U:Amber
CVSS Score: 8.3

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Local	Confidentiality	High	Confidentiality	High
Attack Complexity	Low	Integrity	High	Integrity	High
Attack Requirements	None	Availability	None	Availability	None
Privileges Required	Low
User Interaction	None

CVSS 4.0

Product Status

Vendor	International Datacasting Corporation
Product	SFX2100 Satellite Receiver
Versions	Default: affected Version SFX2100 is affected

Credits

Abdul Mhanni finder

References

Problem Types

CWE-269 Improper Privilege Management CWE

Impacts

CAPEC-233 Privilege Escalation