CISA Raises Severity on an iDirect Satellite Terminal Bug

A satellite terminal that ships from the factory with a low-privilege account already configured can let a local user escalate to full control, under a bug CISA rated 9.4 out of 10 when it updated an advisory on ST Engineering iDirect's iQ-Series terminals Sept. 10.

The update adds two vulnerabilities, CVE-2026-38056 and CVE-2026-38058, to two disclosed when the advisory first published July 2, bringing the total to four in the same iQ200 VSAT modem line. CISA credited Ahmed Alqahtani of Saudi Aramco with reporting the issues, which affect Evolution iQ-Series, 3315-Series and 9-Series terminals running firmware 4.5.2.1 or earlier.

Four bugs, one satellite modem

CVE	Flaw	CVSS v4.0
CVE-2026-38059	Unauthenticated device-identity disclosure	8.7
CVE-2026-38057	Cross-site request forgery forcing reboot	7.0
CVE-2026-38056	Factory low-privilege account enables escalation	9.4
CVE-2026-38058	Root and admin password hashes exposed in config	8.6

The two July bugs work over the network with no credentials: an unauthenticated request to the terminal's REST API returns its serial number, device ID, terminal private key identifier, MAC address and exact firmware version, data CISA says could enable terminal impersonation. A separate flaw skips CSRF-token validation on the reboot endpoint, so a malicious webpage visited by a logged-in administrator can trigger a reboot and, repeated, a denial-of-service condition on the satellite link itself.

The two bugs added in September need local access but go further once an attacker has it. CVE-2026-38056 exploits the pre-configured low-privilege account every iQ200 ships with from the factory, a detail field technicians are the most likely to encounter. CVE-2026-38058 compounds it: the same terminal's configuration API returns a JSON dump that includes a SECURITY section holding MD5-crypt password hashes for the root SSH and web-administration accounts, according to CISA's updated advisory.

Why a satellite modem matters more than a router

The iQ200 is a rackmount modem CISA says is deployed globally across communications, defense, energy, government and transportation sectors, and industry coverage of the advisory describes it as the primary, and often sole, link for offshore rigs and vessels that have no terrestrial network to fall back on. CISA published the update the same week as two other industrial-control advisories: a hardcoded encryption key in pipeline monitoring software and a medical imaging server flaw, neither of which shares a vendor or a codebase with iDirect's terminals but both of which reached the same conclusion CISA keeps reaching about operational-technology gear: authentication and CSRF protections that web applications settled a decade ago are still optional on the devices running critical links.

ST Engineering iDirect's own July guidance recommended upgrading to firmware 4.5.2.2; the September update raises that recommendation to 4.5.3.0, the version that also closes the two new bugs. Neither CISA's advisory nor the vendor's guidance says how many iQ200 terminals are still running exposed management interfaces, the number that would turn four lab-rated bugs into an actual target list. Until that count exists, the practical instruction is the same one CISA gives for most ICS advisories: restrict management interfaces to trusted networks, keep administrative APIs off the public internet, and update before assuming the factory account was ever meant to stay.