iDirect satellite terminals expose critical auth flaws
ST Engineering iDirect iQ-Series satellite terminals contain authentication bypass and CSRF vulnerabilities allowing attackers to steal credentials or trigger denial-of-service.
CISA has disclosed two vulnerabilities in ST Engineering iDirect iQ-Series satellite terminals affecting Evolution iQ, 3315-Series, and 9-Series models running firmware version 4.5.2.1 or earlier. CVE-2026-38059 exposes unauthenticated REST API endpoints that leak sensitive device information including Device ID, Terminal Private Key identifier, serial numbers, and MAC addresses—credentials used for satellite network authentication that could enable terminal impersonation. CVE-2026-38057 is a cross-site request forgery flaw allowing attackers to trigger device reboots via malicious web pages visited by authenticated administrators, resulting in satellite link loss and potential sustained denial-of-service.
The vulnerabilities affect satellite communications infrastructure deployed worldwide across communications, defense, energy, government, and transportation sectors. ST Engineering iDirect has released firmware version 4.5.2.2 to remediate both issues. The vendor recommends restricting management interfaces to trusted networks, avoiding public internet exposure of administrative APIs, and monitoring for anomalous API activity and unexpected reboots.
No active exploitation has been reported to CISA at this time. The advisory was reported by Ahmed Alqahtani of Aramco and represents a significant risk to critical infrastructure organizations relying on satellite communications for operational connectivity.
Mentioned in this report
Detection guidance
Unauthenticated Access to Sensitive Device Info REST API on Satellite Terminal
Detects unauthenticated HTTP requests to management REST API paths that expose device identity/credential material (Device ID, Terminal Private Key ID, serial number, MAC address) as seen in iDirect iQ-Series terminals prior to 4.5.2.2. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unauthenticated Access to Satellite Terminal Device Info API
id: 45d562ed-377b-505d-939e-ab72880dae08
status: experimental
description: Detects HTTP requests to satellite terminal management REST API endpoints
that return device identity and credential-like material (Device ID, Terminal Private
Key identifier, serial number, MAC address) without any authentication/session context,
consistent with CVE-2026-38059 exploitation against iDirect iQ-Series terminals.
references:
- CVE-2026-38059
logsource:
category: proxy
product: network
detection:
selection_api:
c-uri|contains:
- /api/device
- /api/system/info
- /api/terminal
- /api/status
selection_no_auth:
cs-cookie: null
filter_auth_header:
cs-header|contains: Authorization
condition: selection_api and selection_no_auth and not filter_auth_header
falsepositives:
- Legitimate network monitoring tools polling device status APIs with pre-shared credentials
configured incorrectly as headers not captured by the sensor
- Internal asset discovery/inventory scanners hitting the same management API paths
level: high
tags:
- attack.t1190
- attack.initial-access
- cve.2026-38059
author: Vorant
Cross-Site Request Forgery Triggered Reboot on Satellite Terminal Management Interface
Detects a state-changing reboot/restart request to a satellite terminal management interface where the HTTP Referer/Origin header indicates the request originated from a different, third-party domain, consistent with CSRF-based device reboot abuse (CVE-2026-38057). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: CSRF-Style Reboot Request to Satellite Terminal Management Interface
id: 0179eb19-e870-55f0-ac3e-5c1e38e42794
status: experimental
description: Detects HTTP POST/GET requests to reboot or restart endpoints on satellite
terminal management web interfaces where the Referer or Origin header does not match
the terminal's own management hostname, indicating a cross-site request forgery
pattern that can force unexpected device reboots and satellite link loss (CVE-2026-38057).
references:
- CVE-2026-38057
logsource:
category: proxy
product: network
detection:
selection_reboot:
c-uri|contains:
- /reboot
- /restart
- /system/reset
cs-method:
- GET
- POST
filter_same_origin:
cs-referer|contains: cs-host
condition: selection_reboot and not filter_same_origin
falsepositives:
- Legitimate administrator-initiated reboot via bookmarked link or third-party monitoring
dashboard that embeds the device UI
- Load balancer or reverse proxy rewriting Referer/Origin headers for internal management
traffic
level: medium
tags:
- attack.t1499.004
- attack.impact
- cve.2026-38057
author: Vorant
Plaintext Exposure of Terminal Credentials in Unauthenticated API Response
Detects HTTP responses from satellite terminal management APIs containing plaintext credential-identifying material (Terminal Private Key identifier, serial number, MAC address) served without prior authentication, indicating credential exposure via unauthenticated endpoints. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Satellite Terminal API Response Leaking Credential Identifiers
id: 564389a0-d0d7-5ac8-8b93-2e21ef39dd7c
status: experimental
description: Detects HTTP responses from satellite terminal management REST APIs whose
body contains credential-identifying fields (terminal private key identifier, serial
number, MAC address) returned to unauthenticated requests, matching the information-disclosure
behavior described for CVE-2026-38059 on iDirect iQ-Series terminals.
references:
- CVE-2026-38059
logsource:
category: proxy
product: network
detection:
selection_response:
sc-status: 200
r-content|contains:
- private_key
- privateKeyId
- serialNumber
- macAddress
selection_no_auth:
cs-cookie: null
filter_auth_header:
cs-header|contains: Authorization
condition: selection_response and selection_no_auth and not filter_auth_header
falsepositives:
- Internal configuration management or asset inventory tools that legitimately pull
full device configuration including identifiers over pre-authorized network paths
- Vendor support scripts collecting diagnostic bundles from the terminal
level: high
tags:
- attack.t1552.001
- attack.credential-access
- cve.2026-38059
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-183-01
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free