Read the docs
TI-2026-28109 Aliases CVE-2026-38057GHSA-39r6-f6c2-xh29

ST Engineering iDirect iQ-Series Terminals Cross-Site request forgery

Priority LOW 31CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Tampering
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-352.

Summary

The iDirect iQ200 does not validate CSRF tokens on state-changing API endpoints after authentication. The /api/reboot endpoint accepts POST requests authenticated solely by a session cookie that lacks the SameSite attribute. A remote attacker can host a malicious web page that, when visited by an authenticated administrator, automatically submits a cross-site POST request causing an immediate device reboot and satellite link loss. Repeated attacks can sustain a denial-of-service condition.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00313 24th percentileScored 2026-11-07
Fix Fixed Evolution iQ‑Series terminals (ST Engineering iDirect): 4.5.3.03315-Series terminals (ST Engineering iDirect): 4.5.3.0+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ST Engineering iDirectEvolution iQ‑Series terminalsup to 4.5.2.14.5.3.0Patch availableCNA
ST Engineering iDirect3315-Series terminalsup to 4.5.2.14.5.3.0Patch availableCNA
ST Engineering iDirect9-Series Terminalsup to 4.5.2.14.5.3.0Patch availableCNA
  • Evolution iQ‑Series terminals VendorST Engineering iDirect Affected up to 4.5.2.1 Fixed in 4.5.3.0 Patch available CNA
  • 3315-Series terminals VendorST Engineering iDirect Affected up to 4.5.2.1 Fixed in 4.5.3.0 Patch available CNA
  • 9-Series Terminals VendorST Engineering iDirect Affected up to 4.5.2.1 Fixed in 4.5.3.0 Patch available CNA

Remediation

  • Fix · CNA Evolution iQ‑Series terminals (ST Engineering iDirect) Fixed in 4.5.3.0
  • Fix · CNA 3315-Series terminals (ST Engineering iDirect) Fixed in 4.5.3.0
  • Fix · CNA 9-Series Terminals (ST Engineering iDirect) Fixed in 4.5.3.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-38057
  2. 2026-10-03 Alias added: GHSA-39r6-f6c2-xh29

References

Other 3

  • TI-2026-63377 ST Engineering iDirect iDX/Evo iDX HTTP Request authorize response splitting CVSS 4.0MEDIUM 5.3
  • TI-2026-63375 ST Engineering iDirect iDX/Evo iDX Location Header redirect CVSS 4.0MEDIUM 5.3
  • TI-2026-28111 ST Engineering iDirect iQ-Series Terminals Missing authentication for critical function CVSS 4.0HIGH 8.7
  • TI-2026-28108 ST Engineering iDirect iQ-Series Terminals Missing Authorization CVSS 4.0CRITICAL 9.4
  • TI-2026-28110 ST Engineering iDirect iQ-Series Terminals Exposure of Sensitive System Information to an Unauthorized Control Sphere CVSS 4.0HIGH 8.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences