EUVD-2026-76126
GHSA-q5c6-wf9x-9mqx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network endpoint requires only low-privilege web credentials; weak MD5-crypt hash disclosure yields effective root-level scope change (S:C) with C:H and I:H; no availability impact.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
3DescriptionCVE.org
The endpoint on the iDirect iQ200 VSAT terminal returns the complete device configuration as JSON, including the SECURITY section which contains MD5-crypt password hashes for the root SSH and web administration accounts. Any user with valid web credentials can extract these hashes and crack them offline using commodity hardware.
AnalysisAI
Sensitive credential hash exposure in ST Engineering iDirect VSAT terminals allows any authenticated web user to retrieve the complete device configuration - including MD5-crypt password hashes for root SSH and web admin accounts - from a single API endpoint. The iQ-series, 3315-series, and 9-series terminal families are all confirmed affected, with no patched version currently identified. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires valid web credentials for the iDirect terminal management interface - any credential tier appears sufficient based on the description, including low-privilege or read-only accounts. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.6 (High) reflects the attack's network reachability, low complexity, and high confidentiality and integrity impact, gated only on possession of valid web credentials (PR:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch with a confirmed fixed version has been identified at the time of analysis; the CPE version ranges are unbounded wildcards and no specific remediation version appears in the advisory metadata. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all affected iDirect VSAT terminals (iQ-series, 3315-series, 9-series) on your network and immediately reset all web-admin and root SSH account credentials to enforce strong, unique passwords (minimum 16 characters). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Missing authentication on the ST Engineering iDirect iQ200 satellite terminal exposes the /api/identity and /api/ REST e
Local privilege escalation in the ST Engineering iDirect iQ200 VSAT satellite terminal (firmware 23.0.1.0) allows a hold
Cross-site request forgery in ST Engineering iDirect satellite terminals (Evolution iQ-series, including the iQ200, plus
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today