CVE-2026-38058

The iQ200 VSAT terminal exposes a web endpoint that returns the complete device configuration as JSON, including a SECURITY section that contains MD5-crypt password hashes for the root SSH and web administration accounts. Any user who holds valid web credentials, including low-privileged accounts, can call this endpoint and retrieve those hashes. Because MD5-crypt is a fast legacy hash, the attacker can crack the hashes offline on commodity hardware and recover the root SSH and web admin passwords, potentially gaining privileged control of the terminal and the network it anchors. Affected organizations are satellite service providers, enterprises, and other operators deploying iQ200 (and, per the related advisory, iQ-Series) VSAT terminals. There is no CISA KEV listing, no public proof-of-concept, and no known exploitation at this time; the issue was assigned by CISA ICS-CERT with a CVSS 4.0 score of 8.6 (High).

What to do: Consult the ST Engineering iDirect advisory (iQ-Series Terminals, Update A) and apply the fixed firmware it specifies once identified, since no fixed version is given in the available data. Until patched, restrict access to the terminal's web management interface to trusted management networks or VPN access, and minimize or eliminate low-privileged web accounts whose credentials could be used to pull the configuration. Because MD5-crypt hashes can be cracked quickly offline, treat any account that could have queried the endpoint as potentially exposed and rotate the root SSH and web admin passwords.