CVE-2026-28770
Received Received - Intake
XML Injection in IDC SFX Receiver Web Interface Enables XSS

Publication date: 2026-03-04

Last updated on: 2026-03-09

Assigner: Gridware

Description
Improper neutralization of special elements in the /IDC_Logging/checkifdone.cgi script in International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web management Interface version 101 allows for XML Injection. The application reflects un-sanitized user input from the `file` parameter directly into a CDATA block, allowing an authenticated attacker to break out of the tags and inject arbitrary XML elements. An actor is confirmed to be able to turn this into an reflected XSS but further abuse such as XXE may be possible
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-04
Last Modified
2026-03-09
Generated
2026-06-16
AI Q&A
2026-03-04
EPSS Evaluated
2026-06-14
NVD
CVE-2026-28770
EUVD
EUVD-2026-9365
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
datacast sfx2100_firmware *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-91 The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is an XML Injection issue in the /IDC_Logging/checkifdone.cgi script of the International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web management Interface version 101.

The application takes user input from the 'file' parameter and inserts it directly into a CDATA block without proper sanitization. This allows an authenticated attacker to break out of the CDATA tags and inject arbitrary XML elements.

Such injection can be exploited to perform reflected Cross-Site Scripting (XSS), and potentially other attacks like XML External Entity (XXE) attacks.

Impact Analysis

An attacker who is authenticated to the system can exploit this vulnerability to inject malicious XML content, which can lead to reflected Cross-Site Scripting (XSS) attacks.

This can result in unauthorized script execution in the context of the victim's browser, potentially leading to session hijacking, data theft, or other malicious actions.

Further abuse such as XML External Entity (XXE) attacks may also be possible, which can lead to disclosure of sensitive information or denial of service.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-28770. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart