iDirect iQ200 EUVD-2026-42907

Exploitation requires that a valid administrator have an active authenticated session to the terminal's web management interface and that this administrator visit attacker-controlled web content while that session is live (UI:A / user interaction is mandatory). The concrete trigger is a cross-site POST to the /api/reboot endpoint, which succeeds specifically because the session cookie is issued without a SameSite attribute and the endpoint performs no CSRF token validation. Limiting factors: the attack cannot proceed against an unauthenticated or logged-out admin, it depends on the admin's browser being reachable to attacker content, and the management interface must be network-reachable from the victim's browsing context; the payload is fixed to a reboot, so impact is availability/state-change only, not data disclosure.

The vendor CVSS 4.0 score is 7.0 (High) with vector AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H - network reachable, low complexity, no attacker privileges, but requiring active user interaction (a logged-in admin must visit attacker content). Impact is confined to integrity (unauthorized state change) and availability (device reboot / link loss); there is no confidentiality impact and no scope change. No EPSS score, KEV listing, or POC was provided, so exploitation probability signals are absent - this should be treated as a plausible-but-unproven risk rather than confirmed active exploitation. The realistic ceiling is denial-of-service against satellite connectivity, not code execution or data theft, so priority is driven by how critical uptime is for a given OT/ICS deployment. Note the UI:A requirement materially limits mass exploitation: the attacker must socially engineer a specific authenticated operator, making this better suited to targeted disruption than opportunistic scanning.

An attacker crafts a web page containing an auto-submitting hidden form (or fetch) that POSTs to https://<terminal>/api/reboot and lures a currently logged-in iDirect administrator to open it via phishing or a watering-hole link. The victim's browser automatically attaches the session cookie (no SameSite protection), the terminal accepts the forged request with no CSRF token, and the device reboots, dropping the satellite link; the attacker repeats delivery to sustain the outage. No public exploit code is currently identified, but the technique is trivial given AC:L.