CVE-2026-38057: ST Engineering iDirect iQ-Series Terminals Cross-Site request forgery
The iDirect iQ200 does not validate CSRF tokens on state-changing API endpoints after authentication. The /api/reboot endpoint accepts POST requests authenticated solely by a session cookie that lacks the SameSite attribute. A remote attacker can host a malicious web page that, when visited by an authenticated administrator, automatically submits a cross-site POST request causing an immediate device reboot and satellite link loss. Repeated attacks can sustain a denial-of-service condition.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ST Engineering iDirect iQ-Series Terminalsto a version that resolves this vulnerability.Fixed in 4.5.3.0 - Configuration
Update configuration so the session cookie includes the SameSite attribute to prevent cross-site POST requests to /api/reboot.
iDirect iQ-Series Terminals (web/session cookies) SameSite attribute on session cookie = set - Configuration
Ensure the iQ200 validates CSRF tokens on state-changing API endpoints after authentication (including /api/reboot).
iDirect iQ200 CSRF token validation for state-changing API endpoints = enabled - Compensating control
Restrict management interfaces and administrative APIs to trusted networks only (e.g., VPN and/or ACLs) instead of exposing them to the public internet.
- Compensating control
Monitor API activity for anomalies and detect unexpected device reboots to identify repeated denial-of-service attempts.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-38057?
The severity of CVE-2026-38057 is rated high with a score of 7.
How do I fix CVE-2026-38057?
To fix CVE-2026-38057, ensure that CSRF tokens are validated on all state-changing API endpoints and consider implementing SameSite attributes for session cookies.
What type of vulnerability is CVE-2026-38057?
CVE-2026-38057 is a Cross-Site Request Forgery (CSRF) vulnerability.
What software is affected by CVE-2026-38057?
CVE-2026-38057 affects the ST Engineering iDirect iQ200 iQ-Series Terminal.
How can an attacker exploit CVE-2026-38057?
An attacker can exploit CVE-2026-38057 by hosting a malicious web page that manipulates the affected API endpoint when visited by an authenticated user.