iDirect Satellite Modem Flaw Skips Authentication Entirely
Security / news
iDirect Satellite Modem Flaw Skips Authentication Entirely
The pre-configured account CISA flagged needs no stolen password, and the iQ200 modem often serves as the only communications link to offshore rigs and vessels.
An attacker with local console access to an ST Engineering iDirect iQ200 satellite modem can escalate to full administrative control using an account the device ships with by default, no stolen password required. CISA disclosed the flaw, CVE-2026-38056, on Sept. 11 as part of an updated advisory for ST Engineering iDirect's iQ-Series terminals, rating it 9.4 out of 10 on the newer CVSS 4.0 severity scale.
Why the score does not overstate the risk
The device "ships from the factory with a pre-configured low-privilege local user account," CISA's advisory says, intended for field technicians who need shell access for maintenance but not full administrative control. "This built-in account provides the initial access required to exploit this vulnerability," the advisory says. "No additional credentials need to be obtained or brute-forced." The only precondition is physical or console access to the modem itself.
Three older flaws in the same advisory
CISA first published the advisory, tracked as ICSA-26-183-01, on July 10, disclosing two other bugs. CVE-2026-38059 lets an unauthenticated attacker with network access query the terminal's /api/identity endpoint and retrieve its serial number, Device ID and Terminal Private Key identifier, credentials the iDirect platform uses to authenticate a terminal to the satellite network. CISA said the exposure could enable terminal impersonation. CVE-2026-38057 is a cross-site request forgery bug: the /api/reboot endpoint accepts session cookies without the SameSite attribute, letting an attacker trigger repeated reboots. A fourth flaw, CVE-2026-38058, discloses information to anyone holding valid web credentials.
- CVE-2026-380569.4 score out of 10
- CVE-2026-380598.7 score out of 10
- CVE-2026-380588.6 score out of 10
- CVE-2026-380577 score out of 10
Source: NIST National Vulnerability Database, accessed 2026-09-12
Why a satellite modem gets this much scrutiny
The iQ200 is a rackmount VSAT modem CISA describes as deployed across oil and gas, maritime, defense and remote infrastructure, often as the primary or only communications link for offshore rigs, vessels and remote sites. Ahmed Alqahtani of Aramco is credited with reporting the vulnerabilities to CISA.
What changed between July and September
The July 10 version of the advisory covered only CVE-2026-38059 and CVE-2026-38057. CISA's Sept. 10 revision, labeled Update A, added CVE-2026-38056 and CVE-2026-38058 and recalculated the CVSS 4.0 scores for all four. ST Engineering iDirect fixed every flaw in firmware version 4.5.3.0; every terminal running 4.5.2.1 or earlier remains exposed until an operator updates it through ST Engineering iDirect's own support portal. CISA has not said whether any of the four flaws has been exploited, and the advisory carries no indication that field technicians' pre-configured accounts have been changed as a companion fix. CISA has issued other industrial-control advisories in the same window, including one covering flaws in NextGen Healthcare's Mirth Connect integration engine.
The advisory follows a familiar pattern in CISA's industrial-control notices, including its earlier one on AVEVA's pipeline integrity software: equipment whose default configuration trusted a maintenance account more than it should have.
Sources
More in Security
- 01Cisco and Acronis Share a CISA Deadline, Not a Severity ScoreOne flaw needs no password and no user interaction, the other needs an attacker already logged in, and CISA gave federal agencies the same three days to fix both.
- 02Bransys ELD App Shipped With Hardcoded Login CredentialsCISA disclosed three flaws Sept. 17 in the trucking compliance app, including a hardcoded password a researcher says exposed live location and engine data from every connected truck on a subset of fleets.
- 03MikroTik Patches RouterOS Flaws Attackers Exploited FirstPoland's national CERT says attackers began exploiting the chained flaws on Sept. 2, a day before MikroTik shipped a fix, and more than 122,500 routers were still reachable a week later.
- 04Attackers Exploit a JFrog Artifactory Bug in Four DayswatchTowr says attackers began minting administrator tokens by abusing a default empty join key, CVE-2026-82329, within days of JFrog's own patch shipping.