Evolution Iq Series Terminals
Monthly
Local privilege escalation in the ST Engineering iDirect iQ200 VSAT satellite terminal (firmware 23.0.1.0) allows a holder of the factory-installed low-privilege field-technician account to gain full administrative control of the device. Because the low-privilege account ships pre-configured on every unit, no credentials must be phished, obtained, or brute-forced - the initial foothold is built in. No public exploit has been identified at time of analysis; the flaw was reported through CISA ICS-CERT (advisory ICSA-26-183-01).
Sensitive credential hash exposure in ST Engineering iDirect VSAT terminals allows any authenticated web user to retrieve the complete device configuration - including MD5-crypt password hashes for root SSH and web admin accounts - from a single API endpoint. The iQ-series, 3315-series, and 9-series terminal families are all confirmed affected, with no patched version currently identified. Because MD5-crypt is computationally weak against modern GPU-based cracking tools, successful hash extraction typically escalates to full root-level device compromise. Reported by ICS-CERT under advisory ICSA-26-183-01; no public exploit code or active exploitation has been identified at time of analysis.
Missing authentication on the ST Engineering iDirect iQ200 satellite terminal exposes the /api/identity and /api/ REST endpoints to any unauthenticated party on the network, letting them harvest the serial number, Device ID (DID), Terminal Private Key identifier (TPK), MAC address, and firmware version. Because the DID and TPK underpin satellite-network authentication on the iDirect platform, the leaked identifiers can support terminal impersonation and targeted reconnaissance. Reported by CISA ICS-CERT (ICSA-26-183-01); no public exploit identified at time of analysis, and no EPSS score was provided.
Cross-site request forgery in ST Engineering iDirect satellite terminals (Evolution iQ-series, including the iQ200, plus 3315-series and 9-series) lets a remote attacker force an authenticated administrator's browser to submit a POST to the /api/reboot endpoint, rebooting the modem and dropping the satellite link. Because the session cookie lacks a SameSite attribute and no CSRF token is validated, simply luring a logged-in admin to a malicious page triggers the reboot; repeated abuse sustains a denial-of-service against connectivity. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Local privilege escalation in the ST Engineering iDirect iQ200 VSAT satellite terminal (firmware 23.0.1.0) allows a holder of the factory-installed low-privilege field-technician account to gain full administrative control of the device. Because the low-privilege account ships pre-configured on every unit, no credentials must be phished, obtained, or brute-forced - the initial foothold is built in. No public exploit has been identified at time of analysis; the flaw was reported through CISA ICS-CERT (advisory ICSA-26-183-01).
Sensitive credential hash exposure in ST Engineering iDirect VSAT terminals allows any authenticated web user to retrieve the complete device configuration - including MD5-crypt password hashes for root SSH and web admin accounts - from a single API endpoint. The iQ-series, 3315-series, and 9-series terminal families are all confirmed affected, with no patched version currently identified. Because MD5-crypt is computationally weak against modern GPU-based cracking tools, successful hash extraction typically escalates to full root-level device compromise. Reported by ICS-CERT under advisory ICSA-26-183-01; no public exploit code or active exploitation has been identified at time of analysis.
Missing authentication on the ST Engineering iDirect iQ200 satellite terminal exposes the /api/identity and /api/ REST endpoints to any unauthenticated party on the network, letting them harvest the serial number, Device ID (DID), Terminal Private Key identifier (TPK), MAC address, and firmware version. Because the DID and TPK underpin satellite-network authentication on the iDirect platform, the leaked identifiers can support terminal impersonation and targeted reconnaissance. Reported by CISA ICS-CERT (ICSA-26-183-01); no public exploit identified at time of analysis, and no EPSS score was provided.
Cross-site request forgery in ST Engineering iDirect satellite terminals (Evolution iQ-series, including the iQ200, plus 3315-series and 9-series) lets a remote attacker force an authenticated administrator's browser to submit a POST to the /api/reboot endpoint, rebooting the modem and dropping the satellite link. Because the session cookie lacks a SameSite attribute and no CSRF token is validated, simply luring a logged-in admin to a malicious page triggers the reboot; repeated abuse sustains a denial-of-service against connectivity. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.