CVE-2026-38056: ST Engineering iDirect iQ-Series Terminals Missing Authorization
A local privilege escalation vulnerability exists in the iDirect iQ200 VSAT terminal running firmware 23.0.1.0. The iQ200 is a rackmount satellite modem deployed across oil and gas, maritime, defense, and remote infrastructure as the primary, and often sole communications link for offshore rigs, vessels, and remote sites. Important context: the device ships from the factory with a pre-configured low-privilege local user account. This account is intended for field technicians who need shell access for maintenance and diagnostics but should not have full administrative control over the device. This built-in account provides the initial access required to exploit this vulnerability. No additional credentials need to be obtained or brute-forced.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ST Engineering iDirect iQ-Series Terminals (iQ200 VSAT)to a version that resolves this vulnerability.Fixed in 4.5.3.0 - Configuration
Ensure the factory-provisioned local user account remains low-privilege (field technicians needing shell access for maintenance/diagnostics) and does not grant full administrative control.
iDirect iQ200 VSAT terminal (local accounts) local user account privileges = low-privilege only - Compensating control
Restrict management interfaces to trusted networks only (e.g., via VPN and ACLs) rather than exposing them to the public internet.
- Compensating control
Avoid exposing administrative APIs to the public internet.
- Compensating control
Enforce strong authentication practices for management access and API access.
- Compensating control
Monitor for anomalous API activity and unexpected device reboots.
Event History
Frequently Asked Questions
Who is realistically exposed to exploitation?
Deployments using the iQ200 VSAT terminal with firmware 23.0.1.0 are exposed, particularly remote sites where the terminal is the primary or only communications link. Exploitation requires local access to the device.
What access does an attacker need?
An attacker needs local shell access through the factory-configured low-privilege account intended for field technicians. They do not need to obtain or brute-force additional credentials.
Are default deployments affected?
Yes. The pre-configured low-privilege local account ships with the device from the factory and provides the initial access needed for escalation.