CISA Warns of Multiple High-Severity Vulnerabilities in ST Engineering iDirect iQ-Series Satellite Terminals

On September 10, 2026, CISA released an Industrial Control Systems Advisory (ICSA-26-183-01) detailing four vulnerabilities in ST Engineering iDirect iQ-Series satellite terminals. The affected products include Evolution iQ-Series, 3315-Series, and 9-Series terminals running firmware versions up to and including 4.5.2.1. The vulnerabilities carry CVSS scores up to 8.8 (v3) and are rated high severity.

The advisory identifies the following CVEs:

- **CVE-2026-38059** – Missing authentication for critical function: The /api/identity and /api/ REST API endpoints are accessible without authentication. An unauthenticated attacker with network access can retrieve sensitive device information, including serial number, Device ID (DID), Terminal Private Key identifier (TPK), MAC address, and exact firmware version. The DID and TPK are used for satellite network authentication, potentially enabling terminal impersonation and network reconnaissance.

- **CVE-2026-38057** – Cross-Site Request Forgery (CSRF): The /api/reboot endpoint accepts POST requests authenticated only by a session cookie lacking the SameSite attribute. A remote attacker can host a malicious web page that, when visited by an authenticated administrator, triggers an immediate device reboot, causing satellite link loss. Repeated attacks can sustain a denial-of-service condition.

- **CVE-2026-38056** – Local privilege escalation: A local privilege escalation vulnerability exists in the iQ200 VSAT terminal running firmware 23.0.1.0. The advisory notes the iQ200 is a rackmount satellite modem deployed across oil and gas, maritime, defense, and remote industries.

- **CVE-2026-38058** – Details were not fully included in the advisory excerpt, but it is listed alongside the other three CVEs and affects the same product versions.

The affected products are deployed worldwide across critical infrastructure sectors including Communications, Defense Industrial Base, Energy, Government Services and Facilities, and Transportation Systems. ST Engineering iDirect is headquartered in the United States.

ST Engineering iDirect has released fixes in firmware version 4.5.3.0 or newer. Registered users can download patches from the iDirect Support Portal at https://support.idirect.net. The advisory also recommends restricting management interfaces to trusted networks (e.g., VPN, ACLs), avoiding exposure of administrative APIs to the public internet, enforcing strong authentication practices, and monitoring for anomalous API activity and unexpected device reboots.

No confirmed active exploitation of these vulnerabilities has been reported at the time of the advisory. However, given the critical nature of satellite communications in national security and industrial operations, immediate patching is strongly recommended.