A Satellite Receiver Trusted by Pentagon, ESA Has More Than 20 Security Flaws — and the Maker Never Responded

A researcher found 20+ critical vulnerabilities in IDC's SFX2100 satellite receiver — including unauthenticated root RCE via SNMP (default RW community string), hardcoded accounts with password "12345", web command injection, and an FTP writable path allowing replacement of a root-executing binary — impacting systems used by the U.S. DoD, ESA, and other critical infrastructure; IDC did not respond to disclosures and the flaws are likely present across the product line.