CVE-2026-38059

High7.5Published on July 10, 2026

The iDirect iQ200 exposes the /api/identity and /api/ REST API endpoints without authentication. An unauthenticated attacker with network access can retrieve sensitive device information including the serial number, Device ID (DID), Terminal Private Key identifier (TPK), MAC address, and exact firmware version. The DID and TPK are used for satellite network authentication in the iDirect platform, potentially enabling terminal impersonation and network reconnaissance.

CVSS score7.5 / 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness type (CWE)CWE-306

Vulnerabilities

CISA Expands iDirect Satellite Terminal Warning With Critical Privilege-Escalation Flaw

CISA expanded its iDirect advisory with two new flaws exposing credential hashes and enabling critical local privilege escalation on satellite terminals.

Sep 13, 202615:506 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Related articles

CISA Expands iDirect Satellite Terminal Warning With Critical Privilege-Escalation Flaw