CVE-2026-38059

HighCVSS 7.5

Published: 10/07/2026(UTC)Updated: 10/07/2026(UTC)Translated: 11/07/2026(UTC)NVD NIST

Summary

Risk Assessment

The risk includes potential terminal impersonation and satellite network reconnaissance, which could lead to unauthorized network access and compromise of communication integrity.

Recommendation

Immediately implement authentication for the /api/identity and /api/ API endpoints and restrict network access to these interfaces to trusted hosts only.

Other vulnerabilities in iDirect iQ200

CVE-2026-38057High
The iDirect iQ200 device does not validate CSRF tokens on state-changing API endpoints after authentication. The /api/reboot endpoint accepts POST requests authenticated solely by a session cookie lacking the SameSite attribute. A remote attacker can host a malicious web page that, when visited by an authenticated administrator, automatically submits a cross-site POST request causing an immediate device reboot and satellite link loss.

Original NVD description (English source)

The iDirect iQ200 exposes the /api/identity and /api/ REST API endpoints without authentication. An unauthenticated attacker with network access can retrieve sensitive device information including the serial number, Device ID (DID), Terminal Private Key identifier (TPK), MAC address, and exact firmware version. The DID and TPK are used for satellite network authentication in the iDirect platform, potentially enabling terminal impersonation and network reconnaissance.