Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2026-38058

ST Engineering iDirect iQ-Series Terminals Exposure of Sensitive System Information to an Unauthorized Control Sphere

The endpoint on the iDirect iQ200 VSAT terminal returns the complete device configuration as JSON, including the SECURITY section which contains MD5-crypt password hashes for the root SSH and web administration accounts. Any user with valid web credentials can extract these hashes and crack them offline using commodity hardware.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
St Engineering Idirect
Products
3315-series Terminals 9-series Terminals Evolution Iq‑series Terminals
CVE-2026-38056

ST Engineering iDirect iQ-Series Terminals Missing Authorization

A local privilege escalation vulnerability exists in the iDirect iQ200 VSAT terminal running firmware 23.0.1.0. The iQ200 is a rackmount satellite modem deployed across oil and gas, maritime, defense, and remote infrastructure as the primary, and often sole communications link for offshore rigs, vessels, and remote sites. Important context: the device ships from the factory with a pre-configured low-privilege local user account. This account is intended for field technicians who need shell access for maintenance and diagnostics but should not have full administrative control over the device. This built-in account provides the initial access required to exploit this vulnerability. No additional credentials need to be obtained or brute-forced.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
St Engineering Idirect
Products
3315-series Terminals 9-series Terminals Evolution Iq‑series Terminals
CVE-2026-38059

ST Engineering iDirect iQ-Series Terminals Missing authentication for critical function

The iDirect iQ200 exposes the /api/identity and /api/ REST API endpoints without authentication. An unauthenticated attacker with network access can retrieve sensitive device information including the serial number, Device ID (DID), Terminal Private Key identifier (TPK), MAC address, and exact firmware version. The DID and TPK are used for satellite network authentication in the iDirect platform, potentially enabling terminal impersonation and network reconnaissance.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
St Engineering Idirect
Products
3315-series 9-series Terminals Evolution Iq‑series Terminals
CVE-2026-38057

ST Engineering iDirect iQ-Series Terminals Cross-Site request forgery

The iDirect iQ200 does not validate CSRF tokens on state-changing API endpoints after authentication. The /api/reboot endpoint accepts POST requests authenticated solely by a session cookie that lacks the SameSite attribute. A remote attacker can host a malicious web page that, when visited by an authenticated administrator, automatically submits a cross-site POST request causing an immediate device reboot and satellite link loss. Repeated attacks can sustain a denial-of-service condition.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
St Engineering Idirect
Products
3315-series 9-series Terminals Evolution Iq‑series Terminals