iDirect iQ200 CVE-2026-38059

The exploitable condition is concrete: the terminal exposes the /api/identity and /api/ REST endpoints with no authentication (CWE-306), so any party with network reachability to the device's HTTP management interface can read the data - the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no credentials, no user interaction, and no special attack requirement. The main limiting factor is network exposure rather than software configuration: the attacker must have IP reachability to the terminal's management service, which for VSAT ground terminals is often on a private or operator-controlled segment rather than the public Internet, so realistic risk depends on whether the management interface is segmented or exposed. A secondary limit is impact scope - exploitation yields information disclosure of identifiers only (VC:H, VI/VA:N); the described terminal impersonation is a downstream possibility that requires those identifiers to be sufficient for satellite-network authentication.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H, all integrity/availability and subsequent-system metrics N) scores 8.7 and describes a low-complexity, unauthenticated, network-reachable pure-confidentiality disclosure - signals that are internally consistent with the description. Confidentiality is the only impacted dimension: the flaw reads data, it does not directly alter or disable the terminal, so the real-world severity hinges on how exposed these management interfaces are (satellite terminals are frequently on private/management segments rather than the open Internet). No EPSS probability, KEV listing, or POC was provided, so there is no evidence of active or automated exploitation - the risk is best characterized as a high-value reconnaissance/impersonation enabler rather than a direct compromise. The most important caveat: impersonation is described as 'potentially enabling,' meaning the leaked DID/TPK identifiers are a prerequisite for a follow-on attack, not a self-contained account takeover; the practical impact depends on whether those identifiers alone are sufficient for network authentication or merely one factor.

An attacker who can route packets to an iQ200 terminal's management interface issues a simple unauthenticated HTTP GET to /api/identity and immediately receives the serial number, DID, TPK, MAC address, and firmware version. Using the firmware version they fingerprint the exact model for further targeting, and they retain the DID/TPK to attempt terminal impersonation or map the satellite network. No exploit code is required beyond an ordinary HTTP client, though no public POC is identified at time of analysis.