`/bin/date` Binary given SETUID Permissions on IDC SFX2100 Leading to Potential LPE

published 2026-03-05 8 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-9514

cvss: 5.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 5%
public exploits: 0; none known

International Data Casting (IDC) SFX2100 satellite receiver comes with the `/bin/date` utility installed with the setuid bit set. This configuration grants elevated privileges to any local user who can execute the binary. A local actor is able to use the GTFObins resource to preform privileged file reads as the root user on the local file system. This allows an actor to be able to read any root read-only files, such as the /etc/shadow file or other configuration/secrets carrier files.

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 8 mo ago (2026-03-05)

Exploit prediction

0.16% chance of exploitation in the next 30 days, higher than 5% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

abdulmhsblog.com https://www.abdulmhsblog.com/posts/sfx2100-vulns/ referenced PoC, tagged "exploit" by a source, unverified
gtfobins.org https://gtfobins.org/gtfobins/date/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	8.3	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:P
CNA	4.0	8.3	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

International Datacasting Corporation SFX2100 Satellite Receiver

Classification

Weakness

CWE-269 Improper Privilege Management

References

abdulmhsblog.com /posts/sfx2100-vulns/
exploit, third-party-advisory
gtfobins.org /gtfobins/date/
exploit

Sources

CVE List CVE-2026-29122
NVD CVE-2026-29122

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary