ST Engineering iDirect iQ-Series Terminals Authentication Bypass and CSRF Vulnerabilities
First seen Jul 4, 2026 · Updated Jul 4, 2026 · CVSS 8.1
Two high-severity vulnerabilities affect ST Engineering iDirect iQ-Series satellite terminals (Evolution iQ, 3315-Series, 9-Series) running firmware <=4.5.2.1. Successful exploitation could allow an unauthenticated attacker to retrieve sensitive device credentials or force device reboots via CSRF, potentially causing terminal impersonation or denial-of-service on satellite links. No known public exploitation has been reported to CISA at this time.
Technical Analysis
CVE-2026-38059 (CVSS 3.1: 7.5) is a Missing Authentication for Critical Function (CWE-306) flaw in which the /api/identity and /api/ REST endpoints on iDirect iQ200 terminals expose sensitive information—including serial number, Device ID (DID), Terminal Private Key identifier (TPK), MAC address, and firmware version—without requiring authentication, enabling network reconnaissance and potential terminal impersonation on the satellite network. CVE-2026-38057 (CVSS 3.1: 8.1) is a Cross-Site Request Forgery vulnerability (CWE-352) where the /api/reboot endpoint accepts POST requests authenticated only via a session cookie lacking the SameSite attribute, allowing a remote attacker to craft a malicious webpage that triggers an unauthorized reboot when visited by an authenticated administrator, resulting in satellite link loss and sustained denial-of-service if repeated. Both vulnerabilities require network access to the terminal's management interface and do not require prior authentication for CVE-2026-38059, while CVE-2026-38057 requires the victim to be authenticated and to interact with attacker-controlled content (UI:R).
Affected Systems
ST Engineering iDirect Evolution iQ-Series terminals version <=4.5.2.1; ST Engineering iDirect 3315-Series terminals version <=4.5.2.1; ST Engineering iDirect 9-Series terminals version <=4.5.2.1. Fixed in version 4.5.2.2 or newer.
Indicators of Compromise
- No specific IOCs (hashes, IPs, domains) provided; vulnerabilities relate to exposed API endpoints /api/identity, /api/, and /api/reboot on affected terminals.
Remediation Steps
- 1
Update Firmware
Update affected ST Engineering iDirect terminals to version 4.5.2.2 or newer, available via the iDirect Support Portal (https://support.idirect.net/s/login).
- 2
Restrict Management Interface Access
Limit access to management interfaces to trusted networks only, using VPNs and access control lists (ACLs).
- 3
Avoid Public Exposure of APIs
Ensure administrative APIs such as /api/identity, /api/, and /api/reboot are not exposed to the public internet.
- 4
Enforce Strong Authentication
Implement robust authentication mechanisms and ensure session cookies use the SameSite attribute to mitigate CSRF risks.
- 5
Monitor for Anomalous Activity
Monitor API traffic and device logs for unusual access patterns or unexpected reboots that may indicate exploitation attempts.
- 6
Network Segmentation
Isolate control system networks and satellite terminal management interfaces from business and public networks using firewalls.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.