ST Engineering iDirect iQ-Series Terminals (Update A)

CVE-2026-38056 is a critical local privilege escalation flaw (CWE-862, missing authorization) in the ST Engineering iDirect iQ200 rackmount satellite modem running firmware 23.0.1.0. The iQ200 ships from the factory with a built-in low-privilege technician account intended for maintenance and diagnostics, and an attacker who uses that account — or otherwise gains local shell access — can exploit the missing authorization check, since the attack requires no additional privileges or user interaction. Successful exploitation yields full administrative control of the terminal, with high impact on the device's confidentiality, integrity, and availability and on the satellite communications service it provides, which is often the sole communications link for offshore rigs, vessels, and remote sites. Any organization operating an iQ200 on the affected firmware — particularly in oil and gas, maritime, defense, and remote infrastructure — is affected. There is no evidence of exploitation so far: the flaw is not in CISA's KEV, no public proof-of-concept is known, and it was assigned by CISA ICS-CERT in the advisory 'ST Engineering iDirect iQ-Series Terminals (Update A)'.

Do: Inventory all iQ 200 terminals, record their running firmware version, and upgrade to the fixed release identified in the ST Engineering iDirect / CISA ICS-CERT advisory 'ST Engineering iDirect iQ-Series Terminals (Update A)' (the fixed version is not specified in the available data). Until patching is complete, restrict and rotate the factory-built-in technician account credentials and limit local shell access to trusted personnel, since that pre-configured account is the only access the exploit requires and the terminal is frequently the sole communications link at the site.

The iDirect iQ200 does not validate CSRF tokens on state-changing API endpoints after authentication. The /api/reboot endpoint accepts POST requests authenticated solely by a session cookie that lacks the SameSite attribute. A remote attacker can host a malicious web page that, when visited by an authenticated administrator, automatically submits a cross-site POST request causing an immediate device reboot and satellite link loss. Repeated attacks can sustain a denial-of-service condition.

The iQ200 VSAT terminal exposes a web endpoint that returns the complete device configuration as JSON, including a SECURITY section that contains MD5-crypt password hashes for the root SSH and web administration accounts. Any user who holds valid web credentials, including low-privileged accounts, can call this endpoint and retrieve those hashes. Because MD5-crypt is a fast legacy hash, the attacker can crack the hashes offline on commodity hardware and recover the root SSH and web admin passwords, potentially gaining privileged control of the terminal and the network it anchors. Affected organizations are satellite service providers, enterprises, and other operators deploying iQ200 (and, per the related advisory, iQ-Series) VSAT terminals. There is no CISA KEV listing, no public proof-of-concept, and no known exploitation at this time; the issue was assigned by CISA ICS-CERT with a CVSS 4.0 score of 8.6 (High).

Do: Consult the ST Engineering iDirect advisory (iQ-Series Terminals, Update A) and apply the fixed firmware it specifies once identified, since no fixed version is given in the available data. Until patched, restrict access to the terminal's web management interface to trusted management networks or VPN access, and minimize or eliminate low-privileged web accounts whose credentials could be used to pull the configuration. Because MD5-crypt hashes can be cracked quickly offline, treat any account that could have queried the endpoint as potentially exposed and rotate the root SSH and web admin passwords.

The iDirect iQ200 exposes the /api/identity and /api/ REST API endpoints without authentication. An unauthenticated attacker with network access can retrieve sensitive device information including the serial number, Device ID (DID), Terminal Private Key identifier (TPK), MAC address, and exact firmware version. The DID and TPK are used for satellite network authentication in the iDirect platform, potentially enabling terminal impersonation and network reconnaissance.