CISA Expands iDirect Satellite Terminal Warning With Critical Privilege-Escalation Flaw

The US Cybersecurity and Infrastructure Security Agency has expanded its warning about vulnerabilities in ST Engineering iDirect satellite terminals, adding two flaws that expose credential hashes and enable local privilege escalation.

Update A, published on September 10, covers four vulnerabilities affecting Evolution iQ-Series, 3315-Series, and 9-Series terminals running version 4.5.2.1 or earlier. Successful attacks could reveal satellite-authentication data, compromise administrative access, elevate local privileges, or interrupt communications by repeatedly rebooting a terminal.

CISA’s executive summary assigns the advisory an overall CVSS v3 score of 8.8. Individual CVSS v3.1 scores range from 7.5 to 8.8, while the local privilege-escalation vulnerability receives a Critical 9.4 rating under CVSS v4.0.

September Update Adds Two High-Impact Vulnerabilities

CISA initially published the iDirect iQ-Series advisory on July 2. The September 10 update added CVE-2026-38056 and CVE-2026-38058, revised the vulnerability and CVSS v4.0 information, and updated the mitigation language.

The three affected product lines are:

• Evolution iQ-Series terminals, versions 4.5.2.1 and earlier
• 3315-Series terminals, versions 4.5.2.1 and earlier
• 9-Series terminals, versions 4.5.2.1 and earlier

The fixed release number has not been disclosed. CISA advises operators to install the newest product version available from ST Engineering iDirect.

Although the product scope covers three terminal families, the technical descriptions concentrate on the iDirect iQ200. The privilege-escalation finding specifically references an iQ200 VSAT terminal running firmware 23.0.1.0.

These devices are deployed worldwide across communications, defense, energy, government, transportation, maritime, oil and gas, and remote infrastructure. At isolated sites, a satellite terminal may provide the primary or only communications route, making even a short reboot operationally significant.

Exposed APIs Reveal Terminal and Authentication Data

CVE-2026-38059 is an unauthenticated information-disclosure vulnerability caused by missing authentication for a critical function. It has a CVSS v3.1 score of 7.5 and a CVSS v4.0 score of 8.7.

The iQ200 exposes the /api/identity and /api/ REST endpoints to network-accessible attackers without requiring them to log in. Responses can disclose:

• Terminal serial number
• Device ID, or DID
• Terminal Private Key identifier, or TPK
• MAC address
• Exact firmware version

The DID and TPK are used in satellite-network authentication within the iDirect platform. Their exposure does not, by itself, establish that an attacker can take over a terminal. However, the information can support network reconnaissance and attempts to impersonate a device.

The vulnerability requires no privileges and no user interaction. Its direct effect is on confidentiality, but the disclosed firmware version also gives an attacker precise information for selecting subsequent techniques.

Credential Hash Exposure and Local Escalation Create a Path to Control

CVE-2026-38058, rated 8.1 under CVSS v3.1 and 8.6 under CVSS v4.0, exposes sensitive configuration data to users with valid web credentials.

A vulnerable endpoint returns the complete terminal configuration as JSON. Within its SECURITY section are MD5-crypt password hashes for both the root SSH account and the web-administration account.

An attacker does not need to recover the plaintext passwords on the terminal. The hashes can be copied and attacked offline, where rate limits and authentication monitoring no longer provide protection. If the passwords are weak or reused, commodity hardware may be sufficient to recover them and obtain privileged SSH or administrative access.

The second vulnerability added in Update A, CVE-2026-38056, affects local authorization. It carries a CVSS v3.1 score of 8.8 and a Critical CVSS v4.0 score of 9.4.

The affected iQ200 is supplied with a preconfigured, low-privilege local account intended to give field technicians shell access for maintenance and diagnostics. That account should not have administrative powers, but it provides the initial position necessary to exploit the flaw. No additional credentials need to be obtained or brute-forced.

Successful exploitation can compromise confidentiality, integrity, and availability. CISA’s v4.0 assessment also accounts for effects on systems connected to or dependent upon the terminal, which helps explain the Critical rating despite the local attack vector.

A Browser-Based Attack Can Reboot the Satellite Link

CVE-2026-38057 is a cross-site request forgery vulnerability affecting state-changing API operations. It is rated 8.1 under CVSS v3.1 and 7.0 under CVSS v4.0.

After an administrator authenticates, the iQ200 does not validate CSRF tokens for relevant requests. The session cookie also lacks the SameSite attribute. Consequently, the /api/reboot endpoint accepts a cross-origin POST request carrying the administrator’s active session cookie.

An attacker could place the request on a malicious webpage and persuade a logged-in administrator to visit it. The browser would then submit the reboot command without requiring the attacker to authenticate directly to the terminal.

A successful request immediately interrupts the satellite connection. Repeated requests could keep the device cycling through reboots and sustain a denial-of-service condition.

This attack requires administrator interaction, distinguishing it from the unauthenticated identity leak. In environments where the terminal supports offshore operations, a vessel, a defense installation, or an isolated industrial site, the resulting outage may affect far more than routine internet access.

The Four Flaws Can Support a Multi-Stage Intrusion

The vulnerabilities do not depend on one another, but they provide capabilities that could be combined.

An unauthenticated attacker could first use CVE-2026-38059 to inventory the terminal and obtain identity and firmware details. Access to any valid web account could then make CVE-2026-38058 useful for extracting privileged password hashes and attempting offline recovery.

An attacker who reaches the local technician account could exploit CVE-2026-38056 to gain elevated authority. Separately, CVE-2026-38057 offers a way to disrupt the link through an authenticated administrator’s browser.

Potential outcomes include administrative compromise, altered terminal behavior, satellite-network reconnaissance, device impersonation attempts, and loss of communications. The risk is highest where alternative links are unavailable or where downstream operations rely on continuous connectivity.

CISA had received no reports of known public exploitation specifically targeting these four vulnerabilities at the time of its advisory. They are not identified as entries in CISA’s Known Exploited Vulnerabilities catalog, so there is no KEV remediation deadline. Ahmed Alqahtani of Aramco reported the issues.

Operators Should Upgrade, Isolate Management Access, and Hunt for Exposure

Operators should upgrade all affected terminals to the newest release supplied by ST Engineering iDirect. Because the specific fixed version is not stated, organizations should confirm the appropriate release directly through their established vendor-support channel.

Management interfaces should not be directly accessible from the internet. Terminal administration should be limited to trusted management networks, protected by firewalls, and separated from business systems.

Defenders should also:

• Review access to /api/identity, /api/, configuration endpoints, and /api/reboot.
• Investigate requests that retrieved terminal identity data or full JSON configurations.
• Monitor for repeated reboot requests, unexplained restarts, and sudden satellite-link loss.
• Audit the preconfigured technician account and disable or secure it when operationally unnecessary.
• Rotate root SSH and web-administration credentials where configuration data may have been exposed.
• Treat retrieved MD5-crypt hashes as compromised rather than waiting for evidence that they were cracked.
• Look for unusual administrative logins, credential reuse, and unauthorized configuration changes.
• Restrict privileged interfaces to authorized personnel and controlled source addresses.

Changes should undergo an operational impact assessment before deployment, particularly where terminals support safety-critical or remote functions. Network isolation does not correct the underlying software defects, but it can sharply reduce who can reach the vulnerable APIs and administration services.