CVE-2026-28775

This vulnerability allows an attacker with valid login credentials to run any command on the system with full administrative rights by manipulating a specific setting in the web-based Traceroute tool. If exploited, this could enable the attacker to take complete control of the device and potentially compromise the entire network.

This vulnerability allows an attacker who is already logged into the web management interface of the SFX Series satellite receiver to run any command on the device with full root access. By cleverly using certain characters in the input, they can bypass security checks and execute malicious commands, potentially taking complete control of the system.

This vulnerability allows an attacker to run malicious scripts in a user's web browser by sending a specially crafted request to the device's web management interface. It requires the attacker to trick a user into clicking a link that includes the malicious code, which then gets executed without proper checks.

An attacker can inject malicious code into a webpage that users access through the SFX Series SuperFlex Satellite Receiver, which could allow them to run harmful scripts in the victims' browsers. This happens because the device doesn't properly check the input from users before displaying it, and it requires the victim to click on a specially crafted link to trigger the attack.

This vulnerability allows an authenticated attacker to inject malicious XML code into the web management interface of a satellite receiver, potentially leading to reflected cross-site scripting (XSS) attacks. The attacker can exploit this flaw by manipulating the `file` parameter in a specific script, which could also open the door for further attacks like XML External Entity (XXE) attacks.