Read the docs
TI-2026-28108 Aliases CVE-2026-38056GHSA-mrcj-hfx4-rpr6

ST Engineering iDirect iQ-Series Terminals Missing Authorization

Priority MEDIUM 41CWE-862Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

A local privilege escalation vulnerability exists in the iDirect iQ200 VSAT terminal running firmware 23.0.1.0. The iQ200 is a rackmount satellite modem deployed across oil and gas, maritime, defense, and remote infrastructure as the primary, and often sole communications link for offshore rigs, vessels, and remote sites. Important context: the device ships from the factory with a pre-configured low-privilege local user account. This account is intended for field technicians who need shell access for maintenance and diagnostics but should not have full administrative control over the device. This built-in account provides the initial access required to exploit this vulnerability. No additional credentials need to be obtained or brute-forced.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00152 4th percentileScored 2026-11-07
Fix Fixed Evolution iQ‑Series terminals (ST Engineering iDirect): 4.5.3.03315-Series terminals (ST Engineering iDirect): 4.5.3.0+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ST Engineering iDirectEvolution iQ‑Series terminalsup to 4.5.2.14.5.3.0Patch availableCNA
ST Engineering iDirect3315-Series terminalsup to 4.5.2.14.5.3.0Patch availableCNA
ST Engineering iDirect9-Series Terminalsup to 4.5.2.14.5.3.0Patch availableCNA
  • Evolution iQ‑Series terminals VendorST Engineering iDirect Affected up to 4.5.2.1 Fixed in 4.5.3.0 Patch available CNA
  • 3315-Series terminals VendorST Engineering iDirect Affected up to 4.5.2.1 Fixed in 4.5.3.0 Patch available CNA
  • 9-Series Terminals VendorST Engineering iDirect Affected up to 4.5.2.1 Fixed in 4.5.3.0 Patch available CNA

Remediation

  • Fix · CNA Evolution iQ‑Series terminals (ST Engineering iDirect) Fixed in 4.5.3.0
  • Fix · CNA 3315-Series terminals (ST Engineering iDirect) Fixed in 4.5.3.0
  • Fix · CNA 9-Series Terminals (ST Engineering iDirect) Fixed in 4.5.3.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-38056
  2. 2026-10-03 Alias added: GHSA-mrcj-hfx4-rpr6

References

Other 3

  • TI-2026-63377 ST Engineering iDirect iDX/Evo iDX HTTP Request authorize response splitting CVSS 4.0MEDIUM 5.3
  • TI-2026-63375 ST Engineering iDirect iDX/Evo iDX Location Header redirect CVSS 4.0MEDIUM 5.3
  • TI-2026-28111 ST Engineering iDirect iQ-Series Terminals Missing authentication for critical function CVSS 4.0HIGH 8.7
  • TI-2026-28110 ST Engineering iDirect iQ-Series Terminals Exposure of Sensitive System Information to an Unauthorized Control Sphere CVSS 4.0HIGH 8.6
  • TI-2026-28109 ST Engineering iDirect iQ-Series Terminals Cross-Site request forgery CVSS 4.0HIGH 7.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences