CVE-2026-38059

HIGH 7.5

ST Engineering iDirect iQ-Series Terminals Missing authentication for critical function

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

The iDirect iQ200 exposes the /api/identity and /api/ REST API endpoints without authentication. An unauthenticated attacker with network access can retrieve sensitive device information including the serial number, Device ID (DID), Terminal Private Key identifier (TPK), MAC address, and exact firmware version. The DID and TPK are used for satellite network authentication in the iDirect platform, potentially enabling terminal impersonation and network reconnaissance.

CWE	CWE-306
Vendor	st engineering idirect
Product	evolution iq‑series terminals
Published	Jul 10, 2026
Last Updated	Jul 10, 2026

Stay Ahead of the Next One

Get instant alerts for st engineering idirect evolution iq‑series terminals

Be the first to know when new high vulnerabilities affecting st engineering idirect evolution iq‑series terminals are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

ST Engineering iDirect / Evolution iQ‑Series terminals

0 ≤ 4.5.2.1

ST Engineering iDirect / 3315-Series

0 ≤ 4.5.2.1

ST Engineering iDirect / 9-Series Terminals

0 ≤ 4.5.2.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

cisa.gov: https://www.cisa.gov/news-events/ics-advisories/icsa-26-183-01 support.idirect.net: https://support.idirect.net/s/login github.com: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-183-01.json

Credits

Ahmed Alqahtani of Aramco reported this vulnerability to CISA.