ST Engineering iDirect iQ-Series Terminals (Update A)
CISA advisory details four flaws in ST Engineering iDirect iQ-Series VSAT terminals <=4.5.2.1, enabling device data theft, CSRF-driven reboots, and local privilege escalation.
CISA's Update A to ICSA-26-183-01 covers ST Engineering iDirect iQ-Series, 3315-Series and 9-Series terminals at firmware <=4.5.2.1, deployed across communications, defense, energy and transportation. CVE-2026-38059 exposes unauthenticated /api/identity and /api/ endpoints leaking serial number, DID, TPK, MAC address and firmware version, potentially enabling terminal impersonation; CVE-2026-38057 is a CSRF flaw letting an attacker force terminal reboots and satellite link loss via /api/reboot. CVE-2026-38056 enables local privilege escalation using the factory-configured technician account (CVSS 3.1 8.8, CVSS 4.0 9.4), and CVE-2026-38058 exposes crackable MD5-crypt root password hashes. All four flaws were reported to CISA by Ahmed Alqahtani of Aramco.
- Four CVEs affect iQ-Series, 3315-Series and 9-Series terminals at firmware <=4.5.2.1.
- Unauthenticated API endpoints leak DID and TPK identifiers used for satellite network authentication.
- CSRF on /api/reboot can force reboots and sustained denial of satellite connectivity.
- Local privilege escalation scores 8.8 (CVSS 3.1) and 9.4 (CVSS 4.0); password hashes crackable offline.
- VSAT terminals serve as sole communications links for offshore rigs, vessels and remote defense sites.
- Tags
- cisacsrfinformation-disclosureprivilege-escalationsatellite-communicationsst-engineering-idirectvsat
- Vendors
- ST Engineering iDirectCISA
- Organizations
- Aramco
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-38056+1 related CVE | Local Privilege Escalation in ST Engineering iDirect iQ200 VSAT Terminal | 9.4 group max | — | ||
| CVE-2026-38057 | The iDirect iQ200 does not validate CSRF tokens on state-changing API endpoints after authentication | 7.0 | <1% | ||
| CVE-2026-38059 | The iDirect iQ200 exposes the /api/identity and /api/ REST API endpoints without authentication | 8.7 | <1% |
From the original article
4 min read at cisa.govView CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to gain unauthorized access to device information or cause a denial-of-service condition. The following versions of ST Engineering iDirect iQ-Series Terminals (Update A) are affected: Evolution iQ‑Series terminals <=4. 5.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.