Read the docs
TI-2026-28111 Aliases CVE-2026-38059GHSA-h2c7-fwwm-r6w8

ST Engineering iDirect iQ-Series Terminals Missing authentication for critical function

Priority MEDIUM 44CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

The iDirect iQ200 exposes the /api/identity and /api/ REST API endpoints without authentication. An unauthenticated attacker with network access can retrieve sensitive device information including the serial number, Device ID (DID), Terminal Private Key identifier (TPK), MAC address, and exact firmware version. The DID and TPK are used for satellite network authentication in the iDirect platform, potentially enabling terminal impersonation and network reconnaissance.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00592 48th percentileScored 2026-11-07
Fix Fixed Evolution iQ‑Series terminals (ST Engineering iDirect): 4.5.3.03315-Series terminals (ST Engineering iDirect): 4.5.3.0+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ST Engineering iDirectEvolution iQ‑Series terminalsup to 4.5.2.14.5.3.0Patch availableCNA
ST Engineering iDirect3315-Series terminalsup to 4.5.2.14.5.3.0Patch availableCNA
ST Engineering iDirect9-Series Terminalsup to 4.5.2.14.5.3.0Patch availableCNA
  • Evolution iQ‑Series terminals VendorST Engineering iDirect Affected up to 4.5.2.1 Fixed in 4.5.3.0 Patch available CNA
  • 3315-Series terminals VendorST Engineering iDirect Affected up to 4.5.2.1 Fixed in 4.5.3.0 Patch available CNA
  • 9-Series Terminals VendorST Engineering iDirect Affected up to 4.5.2.1 Fixed in 4.5.3.0 Patch available CNA

Remediation

  • Fix · CNA Evolution iQ‑Series terminals (ST Engineering iDirect) Fixed in 4.5.3.0
  • Fix · CNA 3315-Series terminals (ST Engineering iDirect) Fixed in 4.5.3.0
  • Fix · CNA 9-Series Terminals (ST Engineering iDirect) Fixed in 4.5.3.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-38059
  2. 2026-10-03 Alias added: GHSA-h2c7-fwwm-r6w8

References

Other 3

  • TI-2026-63377 ST Engineering iDirect iDX/Evo iDX HTTP Request authorize response splitting CVSS 4.0MEDIUM 5.3
  • TI-2026-63375 ST Engineering iDirect iDX/Evo iDX Location Header redirect CVSS 4.0MEDIUM 5.3
  • TI-2026-28108 ST Engineering iDirect iQ-Series Terminals Missing Authorization CVSS 4.0CRITICAL 9.4
  • TI-2026-28110 ST Engineering iDirect iQ-Series Terminals Exposure of Sensitive System Information to an Unauthorized Control Sphere CVSS 4.0HIGH 8.6
  • TI-2026-28109 ST Engineering iDirect iQ-Series Terminals Cross-Site request forgery CVSS 4.0HIGH 7.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences