iDirect satellite terminals expose critical auth flaws
ST Engineering iDirect iQ-Series satellite terminals contain authentication bypass and CSRF vulnerabilities allowing attackers to steal credentials or trigger denial-of-service.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISA has disclosed two vulnerabilities in ST Engineering iDirect iQ-Series satellite terminals affecting Evolution iQ, 3315-Series, and 9-Series models running firmware version 4.5.2.1 or earlier. CVE-2026-38059 exposes unauthenticated REST API endpoints that leak sensitive device information including Device ID, Terminal Private Key identifier, serial numbers, and MAC addresses—credentials used for satellite network authentication that could enable terminal impersonation. CVE-2026-38057 is a cross-site request forgery flaw allowing attackers to trigger device reboots via malicious web pages visited by authenticated administrators, resulting in satellite link loss and potential sustained denial-of-service.
The vulnerabilities affect satellite communications infrastructure deployed worldwide across communications, defense, energy, government, and transportation sectors. ST Engineering iDirect has released firmware version 4.5.2.2 to remediate both issues. The vendor recommends restricting management interfaces to trusted networks, avoiding public internet exposure of administrative APIs, and monitoring for anomalous API activity and unexpected reboots.
No active exploitation has been reported to CISA at this time. The advisory was reported by Ahmed Alqahtani of Aramco and represents a significant risk to critical infrastructure organizations relying on satellite communications for operational connectivity.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-183-01
Free public brief. The indicators are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs