Which versions of iDirect iQ200 are affected by CVE-2026-38059?

The ST Engineering iDirect iQ200 satellite terminal exposes critical device authentication credentials through unauthenticated APIs, creating immediate risk of terminal impersonation and unauthorized…

How to fix or mitigate CVE-2026-38059?

Within 24 hours: Inventory all iDirect iQ200 terminals and document network exposure; immediately implement firewall rules restricting unauthenticated access to /api/identity and /api/ endpoints from untrusted networks. Within 7 days: Deploy comprehensive API endpoint monitoring and alerting for unauthorized access attempts; validate firewall rule effectiveness across all deployments. Within 30 days: Engage ST Engineering for a security patch or validated network isolation architecture; evaluate operational impact of further endpoint restrictions or terminal isolation pending vendor guidance.

iDirect iQ200 CVE-2026-38059

Q: What is the CVSS score of CVE-2026-38059?

CVE-2026-38059 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

EUVD-2026-42908 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-10 icscert

GHSA-h2c7-fwwm-r6w8

Authentication Bypass Evolution Iq Series Terminals 3315 Series 9 Series Terminals

8.7

CVSS 4.0 · Vendor: icscert

Severity by source

Vendor (icscert) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Unauthenticated network read of the API (AV:N/AC:L/PR:N/UI:N) discloses authentication-relevant identifiers, so C:H; no integrity or availability impact and no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (icscert).

CVSS VectorVendor: icscert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 15:38 vuln.today

DescriptionCVE.org

The iDirect iQ200 exposes the /api/identity and /api/ REST API endpoints without authentication. An unauthenticated attacker with network access can retrieve sensitive device information including the serial number, Device ID (DID), Terminal Private Key identifier (TPK), MAC address, and exact firmware version. The DID and TPK are used for satellite network authentication in the iDirect platform, potentially enabling terminal impersonation and network reconnaissance.

AnalysisAI

Missing authentication on the ST Engineering iDirect iQ200 satellite terminal exposes the /api/identity and /api/ REST endpoints to any unauthenticated party on the network, letting them harvest the serial number, Device ID (DID), Terminal Private Key identifier (TPK), MAC address, and firmware version. Because the DID and TPK underpin satellite-network authentication on the iDirect platform, the leaked identifiers can support terminal impersonation and targeted reconnaissance. Reported by CISA ICS-CERT (ICSA-26-183-01); no public exploit identified at time of analysis, and no EPSS score was provided.

Technical ContextAI

The affected devices are ST Engineering iDirect VSAT satellite ground terminals (the iQ200 and, per the CPE data, the Evolution iQ-series, 3315-series, and 9-series terminals), which run an embedded HTTP REST management interface. The root cause is CWE-306 (Missing Authentication for a Critical Function): the /api/identity and broader /api/ routes serve device identity data without requiring any credential or session. In the iDirect architecture the Device ID and Terminal Private Key identifier are used during satellite-network authentication/enrollment, so what is nominally an information endpoint actually discloses attributes that participate in the platform's trust model - turning an unauthenticated read into an authentication-relevant exposure.

RemediationAI

No vendor-released patch version is identified in the available data; consult the CISA advisory ICSA-26-183-01 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-183-01) and iDirect support (https://support.idirect.net/s/login) for firmware updates and apply any fixed release the vendor lists for your terminal model. Until a patched firmware is confirmed, the primary compensating control is network isolation: place the terminal's management interface on a dedicated, access-controlled segment and block untrusted network reach to the HTTP/REST service, restricting the /api/ and /api/identity endpoints to a management workstation or jump host (trade-off: legitimate remote management must be relayed through that controlled path). Apply firewall/ACL rules to deny inbound access to the management port from client/user VLANs and any Internet-facing path, and monitor for unauthenticated requests to /api/identity as an exposure indicator. Because the leaked DID/TPK identifiers may support impersonation, treat any exposed terminal's identity data as potentially compromised and coordinate with iDirect on re-enrollment or key/identifier rotation where the platform supports it.