CVE-2026-38059: ST Engineering iDirect iQ-Series Terminals Missing authentication for critical function
The iDirect iQ200 exposes the /api/identity and /api/ REST API endpoints without authentication. An unauthenticated attacker with network access can retrieve sensitive device information including the serial number, Device ID (DID), Terminal Private Key identifier (TPK), MAC address, and exact firmware version. The DID and TPK are used for satellite network authentication in the iDirect platform, potentially enabling terminal impersonation and network reconnaissance.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ST Engineering iDirect (iQ-Series Terminals)to a version that resolves this vulnerability.Fixed in 4.5.3.0 - Configuration
Do not expose the /api/identity and /api/ REST API endpoints to the public internet; restrict access so they are not reachable without proper authentication.
iDirect iQ200 /api/identity and /api/ endpoints = authenticated_only - Compensating control
Restrict management interfaces to trusted networks only (e.g., via VPN and/or ACLs).
- Compensating control
Monitor for anomalous API activity and unexpected device reboots.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-38059?
The severity of CVE-2026-38059 is rated as high with a score of 7.5.
What are the potential impacts of CVE-2026-38059?
CVE-2026-38059 allows unauthorized access to sensitive device information, which could lead to further exploitation.
How do I fix CVE-2026-38059?
To mitigate CVE-2026-38059, ensure that access to the /api/identity and /api/ endpoints is properly secured with authentication.
Which devices are affected by CVE-2026-38059?
CVE-2026-38059 affects the ST Engineering iDirect iQ200 iQ-Series Terminals.
Can CVE-2026-38059 be exploited remotely?
Yes, CVE-2026-38059 can be exploited by an unauthenticated attacker with network access to the affected device.