CVE-2026-38056ST Engineering iDirect iQ-Series Terminals Missing Authorization
Updated under an hour ago ()
Does this affect you?
It affects ST Engineering iDirect Evolution iQ‑Series terminals and 2 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
A local privilege escalation vulnerability exists in the iDirect iQ200 VSAT terminal running firmware 23.0.1.0. The iQ200 is a rackmount satellite modem deployed across oil and gas, maritime, defense, and remote infrastructure as the primary, and often sole communications link for offshore rigs, vessels, and remote sites. Important context: the device ships from the factory with a pre-configured low-privilege local user account. This account is intended for field technicians who need shell access for maintenance and diagnostics but should not have full administrative control over the device. This built-in account provides the initial access required to exploit this vulnerability. No additional credentials need to be obtained or brute-forced.
- CVSS
- 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Weakness (CWE)
- CWE-862
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- icscert
- NVD analysis
- Awaiting Analysis
- Record last updated
- Sep 11, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
ST Engineering iDirect Evolution iQ‑Series terminals st_engineering_idirect:evolution_iq_series_terminals (from the name) | through 4.5.2.1; 4.5.3.0 not affected | CNA record |
ST Engineering iDirect 3315-Series terminals st_engineering_idirect:3315_series_terminals (from the name) | through 4.5.2.1; 4.5.3.0 not affected | CNA record |
ST Engineering iDirect 9-Series Terminals st_engineering_idirect:9_series_terminals (from the name) | through 4.5.2.1; 4.5.3.0 not affected | CNA record |
References
- https://support.idirect.net
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-183-01
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-183-01.json
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.