EUVD-2026-76127
GHSA-mrcj-hfx4-rpr6
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local access via the built-in low-privilege account makes AV:L and PR:L honest; full admin takeover yields C:H/I:H/A:H on the same device, so scope unchanged.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
6DescriptionCVE.org
A local privilege escalation vulnerability exists in the iDirect iQ200 VSAT terminal running firmware 23.0.1.0. The iQ200 is a rackmount satellite modem deployed across oil and gas, maritime, defense, and remote infrastructure as the primary, and often sole communications link for offshore rigs, vessels, and remote sites. Important context: the device ships from the factory with a pre-configured low-privilege local user account. This account is intended for field technicians who need shell access for maintenance and diagnostics but should not have full administrative control over the device. This built-in account provides the initial access required to exploit this vulnerability. No additional credentials need to be obtained or brute-forced.
AnalysisAI
Local privilege escalation in the ST Engineering iDirect iQ200 VSAT satellite terminal (firmware 23.0.1.0) allows a holder of the factory-installed low-privilege field-technician account to gain full administrative control of the device. Because the low-privilege account ships pre-configured on every unit, no credentials must be phished, obtained, or brute-forced - the initial foothold is built in. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local access to an affected iDirect terminal using the factory-shipped, pre-configured low-privilege field-technician shell account - this built-in account is the exact prerequisite and, per the description, no additional credentials must be obtained or brute-forced. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 4.0 base score of 9.4 is driven by high confidentiality, integrity, and availability impact on both the vulnerable and subsequent systems, but the vector's PR:N (no privileges required) conflicts with the description, which states exploitation depends on a pre-installed low-privilege account - this is better modeled as PR:L, so the raw score likely overstates true exposure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult CISA advisory ICSA-26-183-01 and ST Engineering iDirect support (https://support.idirect.net) for the fixed firmware release; no exact patched version was provided in the input, so this is best described as patch guidance available per the vendor/CISA advisory rather than a confirmed fixed build - do not assume a version number. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all iQ200 terminals running firmware 23.0.1.0 or earlier in your environment and immediately restrict network access through firewall rules; disable remote management features where operations permit. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Missing authentication on the ST Engineering iDirect iQ200 satellite terminal exposes the /api/identity and /api/ REST e
Cross-site request forgery in ST Engineering iDirect satellite terminals (Evolution iQ-series, including the iQ200, plus
Sensitive credential hash exposure in ST Engineering iDirect VSAT terminals allows any authenticated web user to retriev
Same weakness CWE-862 – Missing Authorization
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today