High ICSA-26-183-01 4 CVEs

ST Engineering iDirect iQ-Series Terminals (Update A)

Published Jul 2, 2026 · Updated Sep 10, 2026 · Revision 2

Vendor: ST Engineering iDirect Product: 3315-Series terminals Product: 9-Series Terminals Product: Evolution iQ‑Series terminals

Summary

Successful exploitation of these vulnerabilities could allow an attacker to gain unauthorized access to device information or cause a denial-of-service condition.

Vulnerabilities 4

High 8.8

CVE-2026-38056 Public exploit

ST Engineering iDirect iQ-Series Terminals Missing Authorization

A local privilege escalation vulnerability exists in the iDirect iQ200 VSAT terminal running firmware 23.0.1.0. The iQ200 is a rackmount satellite modem deployed across oil and gas, maritime, defense, and remote infrastructure as the primary, and often sole c…

ST Engineering iDirect 3315-Series terminals Evolution iQ‑Series terminals 9-Series Terminals

Sep 11, 2026
High 8.1

CVE-2026-38057

ST Engineering iDirect iQ-Series Terminals Cross-Site request forgery

The iDirect iQ200 does not validate CSRF tokens on state-changing API endpoints after authentication. The /api/reboot endpoint accepts POST requests authenticated solely by a session cookie that lacks the SameSite attribute. A remote attacker can host a malic…

ST Engineering iDirect Evolution iQ‑Series terminals 9-Series Terminals 3315-Series terminals

Jul 10, 2026
High 8.1

CVE-2026-38058

ST Engineering iDirect iQ-Series Terminals Exposure of Sensitive System Information to an Unauthorized Control Sphere

The endpoint on the iDirect iQ200 VSAT terminal returns the complete device configuration as JSON, including the SECURITY section which contains MD5-crypt password hashes for the root SSH and web administration accounts. Any user with valid web credentials ca…

ST Engineering iDirect 3315-Series terminals Evolution iQ‑Series terminals 9-Series Terminals

Sep 11, 2026
High 7.5

CVE-2026-38059

ST Engineering iDirect iQ-Series Terminals Missing authentication for critical function

The iDirect iQ200 exposes the /api/identity and /api/ REST API endpoints without authentication. An unauthenticated attacker with network access can retrieve sensitive device information including the serial number, Device ID (DID), Terminal Private Key ident…

ST Engineering iDirect 9-Series Terminals 3315-Series terminals Evolution iQ‑Series terminals

Jul 10, 2026

Revision history

2026-09-10 #2
Update A - Updated Vulnerabilities and CVSS 4.0 score in Executive Summary. Added CVE-2026-38056 and CVE-2026-38058. Updated Mitigation section with newest product version.
2026-07-02 #1
Initial Publication

References

ICSA Advisory ICSA-26-183-01 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-26-183-01
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
Recommended Practices
https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf
Recommended Practices
https://www.cisa.gov/uscert/ncas/tips/ST04-014
Recommended Practices
https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01
Recommended Practices
https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b
Recommended Practices
https://www.cisa.gov/secure-our-world/teach-employees-avoid-phishing
Recommended Practices
https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks