Hardcoded FTP Credentials and LPE(via Insecure Permissions) for `xd` Local Account on IDC SFX2100

International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver contains undocumented, hardcoded/insecure credentials for the `xd` user account. A remote unauthenticated attacker can log in via FTP using these credentials. Because the `xd` user has write permissions to their home directory where root-executed binaries and symlinks (such as those invoked by `xdstartstop`) are stored, the attacker can overwrite these files or manipulate symlinks to achieve arbitrary code execution as the root user.

N/A

使用硬编码的凭证

International Datacasting SFX2100 SuperFlex Satellite Receiver 安全漏洞

International Datacasting SFX2100 SuperFlex Satellite Receiver是美国International Datacasting公司的一个专业广播级卫星信号接收设备。 International Datacasting SFX2100 SuperFlex Satellite Receiver存在安全漏洞，该漏洞源于xd用户账户存在硬编码凭证，可能导致未经身份验证的远程访问和任意代码执行。

N/A

N/A