iDirect iQ200 CVE-2026-38058

Exploitation requires valid web credentials for the iDirect terminal management interface - any credential tier appears sufficient based on the description, including low-privilege or read-only accounts. The web management interface must be network-accessible from the attacker's position. After hash retrieval, successful offline cracking depends on password complexity and the inherent weakness of MD5-crypt; accounts using dictionary-based or short passwords are at highest risk. No special non-default configuration is required beyond the web interface being enabled, which is typical for managed VSAT deployments. Limiting factors: the attacker must first obtain valid web credentials through phishing, credential reuse, or prior compromise; cracking is probabilistic and fails against high-entropy passwords; and network segmentation that prevents access to the management interface entirely blocks the attack.

The CVSS 4.0 score of 8.6 (High) reflects the attack's network reachability, low complexity, and high confidentiality and integrity impact, gated only on possession of valid web credentials (PR:L). The absence of a CISA KEV listing and no confirmed public POC reduce immediate urgency relative to the raw score, but the attack chain is straightforward: any low-privilege web user can request the configuration endpoint, extract the root hash, and crack it offline - even a mid-sized satellite network operator or remote-site IT team in kielce deploying iQ-series terminals for WAN backhaul should treat this as urgent if web admin interfaces are accessible beyond a hardened management VLAN. The inherent weakness of MD5-crypt amplifies practical impact well beyond a standard information-disclosure classification: hash acquisition is a reliable deferred path to full device compromise against all but the strongest passwords. No EPSS score was provided in the input data; given the VSAT-sector footprint and ICS-CERT reporting, exploitation is plausible but likely targeted rather than opportunistic.

An attacker with any valid web credential on an iDirect iQ200 terminal - including a low-privilege monitoring account - issues a single authenticated HTTP request to the device configuration API endpoint. The returned JSON document includes the SECURITY section containing MD5-crypt hashes for root SSH and web admin accounts. Using a GPU-equipped workstation and a tool such as Hashcat with a standard wordlist, the attacker cracks the root hash within hours to days depending on password complexity, then authenticates via SSH as root to reconfigure the satellite link, intercept traffic, or establish persistent backdoor access.