iDirect iQ200 CVE-2026-38056

Exploitation requires local access to an affected iDirect terminal using the factory-shipped, pre-configured low-privilege field-technician shell account - this built-in account is the exact prerequisite and, per the description, no additional credentials must be obtained or brute-forced. Limiting factors: the vector is local (AV:L), so the attacker needs an existing shell/console foothold on the specific device rather than network reach; exploitation is confined to the affected terminal series running the vulnerable firmware. Note the vendor vector lists PR:N, but the description's dependence on the built-in account effectively makes possession of that low-privilege account the true precondition.

The vendor CVSS 4.0 base score of 9.4 is driven by high confidentiality, integrity, and availability impact on both the vulnerable and subsequent systems, but the vector's PR:N (no privileges required) conflicts with the description, which states exploitation depends on a pre-installed low-privilege account - this is better modeled as PR:L, so the raw score likely overstates true exposure. The attack vector is local (AV:L), which meaningfully limits reach: an attacker needs the technician account on the device, not blind internet access. Offsetting that, the barrier is unusually low because the credential ships from the factory, so anyone with physical/console/existing shell access effectively already meets the prerequisite. There is no CISA KEV listing and no public exploit identified, and no EPSS figure was supplied, so there is no signal of active or automated exploitation yet; the realistic threat model is an insider, a compromised field technician, or an attacker who has already reached the terminal, and given these modems are the sole comms link for offshore rigs, vessels, and remote sites, operators of affected fleets should treat it as urgent despite the local vector.

A field technician (or an attacker who has obtained physical/console access to an offshore rig or vessel terminal) logs in with the built-in low-privilege maintenance account, then invokes a privileged operation that is not properly authorization-gated to escalate to full administrative control of the modem. From there they can alter routing, disable the link, or persist on the sole communications path for the site. No public exploit code is identified, and the local attack vector means the attacker must first reach the device.