TI-2026-63377 CVE-2026-94216 · GHSA-mg2v-v6xc-r2vv
ST Engineering iDirect iDX/Evo iDX HTTP Request authorize response splitting
Priority MEDIUM 57
A vulnerability was determined in ST Engineering iDirect iDX and Evo iDX.
ST Engineering iDirect
Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9
Exploited now
ST Engineering iDirect records in CISA KEVNo ST Engineering iDirect vulnerabilities are listed in CISA KEV.
Records
6 records
TI-2026-63375 CVE-2026-94214 · GHSA-63rf-9q6v-xw3g
ST Engineering iDirect iDX/Evo iDX Location Header redirect
Priority MEDIUM 57
A vulnerability was found in ST Engineering iDirect iDX and Evo iDX.
TI-2026-28111 CVE-2026-38059 · GHSA-h2c7-fwwm-r6w8
ST Engineering iDirect iQ-Series Terminals Missing authentication for critical function
Priority MEDIUM 44
The iDirect iQ200 exposes the /api/identity and /api/ REST API endpoints without authentication.
TI-2026-28108 CVE-2026-38056 · GHSA-mrcj-hfx4-rpr6
ST Engineering iDirect iQ-Series Terminals Missing Authorization
Priority MEDIUM 41
A local privilege escalation vulnerability exists in the iDirect iQ200 VSAT terminal running firmware 23.0.1.0.
TI-2026-28110 CVE-2026-38058 · GHSA-q5c6-wf9x-9mqx
ST Engineering iDirect iQ-Series Terminals Exposure of Sensitive System Information to an Unauthorized Control Sphere
Priority MEDIUM 40
The endpoint on the iDirect iQ200 VSAT terminal returns the complete device configuration as JSON, including the SECURITY section which contains MD5-crypt password hashes for the root SSH and web administration accounts.
TI-2026-28109 CVE-2026-38057 · GHSA-39r6-f6c2-xh29
ST Engineering iDirect iQ-Series Terminals Cross-Site request forgery
Priority LOW 31
The iDirect iQ200 does not validate CSRF tokens on state-changing API endpoints after authentication.