CVE-2026-38058: ST Engineering iDirect iQ-Series Terminals Exposure of Sensitive System Information to an Unauthorized Control Sphere
The endpoint on the iDirect iQ200 VSAT terminal returns the complete device configuration as JSON, including the SECURITY section which contains MD5-crypt password hashes for the root SSH and web administration accounts. Any user with valid web credentials can extract these hashes and crack them offline using commodity hardware.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ST Engineering iDirect iQ-Series Terminals (iQ200 VSAT)to a version that resolves this vulnerability.Fixed in 4.5.3.0 or newer - Configuration
Restrict management interfaces to trusted networks (e.g., VPN, ACLs) instead of public access.
iDirect iQ-Series Terminals management interfaces restrict management interfaces to trusted networks = VPN/ACLs only - Compensating control
Avoid exposing administrative APIs to the public internet.
- Compensating control
Enforce strong authentication practices for web and SSH administration accounts.
- Compensating control
Monitor for anomalous API activity and unexpected device reboots.
Event History
Frequently Asked Questions
What level of access does an attacker need to retrieve the password hashes?
The attacker needs valid web credentials. The exposed endpoint returns the full device configuration, including MD5-crypt hashes for the root SSH and web administration accounts.
What could an attacker do with the retrieved information?
The hashes can be cracked offline with commodity hardware. Successful cracking could reveal passwords for the root SSH account and the web administration account.
How can administrators determine whether a terminal is affected?
Administrators can authenticate to the iQ200 terminal's web interface and check whether its configuration endpoint returns complete JSON configuration data containing a SECURITY section with MD5-crypt password hashes.