Which versions of iDirect iQ200 are affected by CVE-2026-38057?

ST Engineering iDirect satellite terminals (Evolution iQ-series, 3315-series, 9-series) are vulnerable to unauthenticated cross-site request forgery attacks that force authenticated administrators to…

How to fix or mitigate CVE-2026-38057?

Within 24 hours: Audit endpoint logs for POST requests to /api/reboot and restrict network access to that endpoint to authorized administration networks only; alert admins to avoid suspicious links. Within 7 days: Contact ST Engineering for patch timeline and interim workaround options; evaluate deploying Web Application Firewall rules to block suspicious POST patterns to /api/reboot; enable enhanced monitoring for rapid reboot sequences from authenticated admin sessions. Within 30 days: Apply vendor patch immediately upon release; implement SameSite=Strict on all session cookies and CSRF token validation on state-changing endpoints; consider network-level rate limiting on reboot operations.

iDirect iQ200 CVE-2026-38057

Q: What is the CVSS score of CVE-2026-38057?

CVE-2026-38057 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-42907 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-07-10 icscert

GHSA-39r6-f6c2-xh29

CSRF Evolution Iq Series Terminals 3315 Series 9 Series Terminals

7.0

CVSS 4.0 · Vendor: icscert

Severity by source

Vendor (icscert) PRIMARY

7.0 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.1 HIGH

Network-reachable CSRF with low complexity and no attacker privileges but mandatory admin interaction (UI:R); no data exposure (C:N), a forced state-change action (I:L), and reboot-driven outage (A:H).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (icscert).

CVSS VectorVendor: icscert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 15:37 vuln.today

DescriptionCVE.org

The iDirect iQ200 does not validate CSRF tokens on state-changing API endpoints after authentication. The /api/reboot endpoint accepts POST requests authenticated solely by a session cookie that lacks the SameSite attribute. A remote attacker can host a malicious web page that, when visited by an authenticated administrator, automatically submits a cross-site POST request causing an immediate device reboot and satellite link loss. Repeated attacks can sustain a denial-of-service condition.

AnalysisAI

Cross-site request forgery in ST Engineering iDirect satellite terminals (Evolution iQ-series, including the iQ200, plus 3315-series and 9-series) lets a remote attacker force an authenticated administrator's browser to submit a POST to the /api/reboot endpoint, rebooting the modem and dropping the satellite link. Because the session cookie lacks a SameSite attribute and no CSRF token is validated, simply luring a logged-in admin to a malicious page triggers the reboot; repeated abuse sustains a denial-of-service against connectivity. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

The affected devices are ST Engineering iDirect Evolution satellite ground terminals/modems that expose a web-based management API. The root cause is CWE-352 (Cross-Site Request Forgery): state-changing endpoints such as /api/reboot authorize requests solely on the presence of a session cookie and do not require an anti-CSRF token or verify request origin. Compounding this, the session cookie is set without the SameSite attribute, so browsers attach it to cross-site POST requests. This combination means any page an authenticated admin visits can drive privileged actions in the terminal's management plane. CPE data confirms the affected products as cpe:2.3:a:st_engineering_idirect:evolution_iq-series_terminals, cpe:2.3:a:st_engineering_idirect:3315-series, and cpe:2.3:a:st_engineering_idirect:9-series_terminals.

RemediationAI

No vendor-released patch version is identified in the available data; consult the CISA advisory (https://www.cisa.gov/news-events/ics-advisories/icsa-26-183-01) and the iDirect support portal (https://support.idirect.net/s/login) for firmware updates and apply the vendor-recommended fixed release once published. As compensating controls, restrict management-interface access to a dedicated out-of-band or VLAN-segmented network so administrators cannot browse the general web while holding an active terminal session (trade-off: added operational overhead for admins). Enforce that administrators log out of the terminal UI immediately after use to eliminate the standing authenticated session the attack depends on, and consider a browser/network policy that blocks admin workstations from arbitrary external sites during management sessions. If the platform supports it, place the management UI behind a reverse proxy that adds Origin/Referer checking or a synchronizer token, and if configurable, set the session cookie to SameSite=Strict - these reduce cross-site submission at the cost of possible UI compatibility testing.