Multiple SUID Root Binaries in `xd` User Home Directory Leading to Potential Local Privilege Escalation

The primary impact of CVE-2026-29123 is the potential for a local attacker to gain root privileges on the SFX2100 Satellite Receiver. This could allow the attacker to completely compromise the device, including accessing sensitive data, installing malware, and potentially using the device as a pivot point to attack other systems on the network. The vulnerability is exploitable through techniques like PATH hijacking, where an attacker can place a malicious executable earlier in the PATH environment variable, causing the SUID binary to execute it instead. Symlink abuse could allow an attacker to trick the binary into executing a malicious file by creating a symbolic link to it. Shared object hijacking involves replacing a legitimate shared object with a malicious one.

Systems utilizing the SFX2100 Satellite Receiver in environments with limited access controls are at higher risk. Shared hosting environments or deployments where the receiver is exposed to untrusted networks should be prioritized for mitigation efforts. Legacy configurations with outdated security practices are also particularly vulnerable.

• linux / server:

find /home/xd/terminal -type f -perm +s -user root

• linux / server:

journalctl -u XDTerminal | grep -i error

• linux / server:

ps aux | grep XDTerminal

• linux / server:

ls -l /home/xd/terminal/XDTerminal

1. 2026-03-05Disclosure

   disclosure

1. Reserviert2026-03-04
2. Veröffentlicht2026-03-05
3. EPSS aktualisiert2026-03-23

Since a patch is not currently available for CVE-2026-29123, mitigation focuses on reducing the attack surface and limiting the potential impact. The most immediate step is to restrict access to the /home/xd/terminal/XDTerminal directory, ensuring that only authorized users can access it. Implement strict file permissions on the XDTerminal binary itself, ensuring that it can only be executed by the root user. Consider using AppArmor or SELinux to further restrict the binary's capabilities and prevent it from accessing sensitive resources. Regularly audit the system for any suspicious files or modifications in the /home/xd/terminal directory. After implementing these mitigations, verify the effectiveness by attempting to execute the XDTerminal binary as a non-root user and confirming that it fails to escalate privileges.