CVE-2026-29128 Overview
IDC SFX2100 Satellite Receiver firmware ships with multiple daemon configuration files for routing components (e.g., zebra, bgpd, ospfd, and ripd) that are owned by root but world-readable. The configuration files (zebra.conf, bgpd.conf, ospfd.conf, ripd.conf) contain hardcoded or otherwise insecure plaintext passwords, including "enable"/privileged-mode credentials. A remote actor is able to abuse the reuse/hardcoded nature of these credentials to further access other systems in the network, gain a foothold on the satellite receiver, or potentially locally privilege escalate.
Critical Impact
Hardcoded credentials in world-readable routing daemon configuration files enable attackers to gain unauthorized access to network infrastructure, establish persistence on satellite receivers, and potentially escalate privileges across connected systems.
Affected Products
- IDC SFX2100 Satellite Receiver Firmware
Discovery Timeline
- 2026-03-05 - CVE CVE-2026-29128 published to NVD
- 2026-03-05 - Last updated in NVD database
Technical Details for CVE-2026-29128
Vulnerability Analysis
This vulnerability falls under CWE-522 (Insufficiently Protected Credentials) and represents a serious firmware security flaw in the IDC SFX2100 Satellite Receiver. The core issue stems from insecure storage and exposure of authentication credentials within routing daemon configuration files.
The affected configuration files for routing protocols (Zebra, BGP, OSPF, and RIP daemons) contain plaintext passwords that are accessible to any user on the system due to world-readable file permissions. These credentials include privileged "enable" mode passwords that provide elevated access to routing infrastructure. The combination of hardcoded credentials and improper file permissions creates a compounding security weakness that significantly expands the attack surface.
An attacker with local access to the device can read these configuration files and extract the plaintext credentials. Due to the hardcoded nature of these passwords across devices, the credentials can potentially be reused to access other SFX2100 units or related network infrastructure. This credential reuse pattern is particularly dangerous in satellite communication networks where multiple receivers may share common configurations.
Root Cause
The root cause of this vulnerability is twofold: first, the use of hardcoded plaintext passwords in routing daemon configuration files rather than implementing proper credential management; and second, the misconfiguration of file permissions that allows any local user to read sensitive configuration data owned by root. This represents a fundamental failure in secure firmware development practices and violates the principle of least privilege.
Attack Vector
The attack vector requires local access to the satellite receiver system. An attacker who gains initial access to the device (through another vulnerability, physical access, or compromised credentials) can read the world-readable configuration files located in standard paths such as /etc/quagga/ or similar directories. The extracted credentials can then be leveraged for:
- Lateral Movement: Using harvested credentials to authenticate to other satellite receivers or network devices that share the same hardcoded passwords
- Privilege Escalation: Utilizing the "enable" mode credentials to gain administrative access to routing daemons
- Network Manipulation: Modifying routing tables through authenticated access to BGP, OSPF, or RIP daemons to redirect or intercept network traffic
The attack complexity is elevated due to the requirement for local access, but once achieved, exploitation is straightforward as it only requires reading plaintext files.
Detection Methods for CVE-2026-29128
Indicators of Compromise
- Unauthorized read access attempts to routing configuration files (zebra.conf, bgpd.conf, ospfd.conf, ripd.conf)
- Unexpected authentication attempts to routing daemons from internal sources
- Unusual login patterns or credential usage across multiple satellite receiver units
- Modified routing tables or unexpected route advertisements in network infrastructure
Detection Strategies
- Monitor file access logs for reads of /etc/quagga/*.conf or similar routing daemon configuration paths by non-root processes
- Implement network-based detection for authentication attempts to routing protocol ports (TCP 2601-2605 for Zebra/Quagga daemons)
- Deploy endpoint detection to identify credential harvesting activities on satellite receiver devices
- Correlate authentication events across multiple SFX2100 units to detect credential reuse patterns
Monitoring Recommendations
- Enable and centralize logging for all routing daemon authentication events
- Implement file integrity monitoring (FIM) on routing configuration files to detect unauthorized access or modifications
- Monitor network traffic for unexpected routing protocol communications originating from compromised endpoints
How to Mitigate CVE-2026-29128
Immediate Actions Required
- Restrict file permissions on all routing daemon configuration files to be readable only by root (e.g., chmod 600 /etc/quagga/*.conf)
- Change all default and hardcoded passwords in routing daemon configurations to unique, strong credentials for each device
- Implement network segmentation to isolate satellite receivers from sensitive network infrastructure
- Audit all SFX2100 units in the environment for credential exposure and unauthorized access
Patch Information
No vendor patch information is currently available for this vulnerability. Organizations should monitor the Abdul MHS Blog Vulnerability Analysis for updates and contact IDC for official remediation guidance.
Workarounds
- Immediately change file permissions on configuration files: chmod 600 /etc/quagga/*.conf (or equivalent paths)
- Replace all hardcoded passwords with unique, strong credentials and store them securely
- Implement access control lists (ACLs) to restrict which users and processes can access routing daemon configurations
- Consider disabling unused routing daemons if they are not required for satellite receiver operation
# Configuration example - Restrict routing daemon config file permissions
chmod 600 /etc/quagga/zebra.conf
chmod 600 /etc/quagga/bgpd.conf
chmod 600 /etc/quagga/ospfd.conf
chmod 600 /etc/quagga/ripd.conf
chown root:root /etc/quagga/*.conf
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
