CVE-2026-38058

Summary

The endpoint on the iDirect iQ200 VSAT terminal returns the complete device configuration as JSON, including the SECURITY section which contains MD5-crypt password hashes for the root SSH and web administration accounts. Any user with valid web credentials can extract these hashes and crack them offline using commodity hardware.

Affected Software

VendorProductVersion RangeStatus
ST Engineering iDirectEvolution iQ‑Series terminals0 <= 4.5.2.1affected
ST Engineering iDirectEvolution iQ‑Series terminals4.5.3.0unaffected
ST Engineering iDirect3315-Series terminals0 <= 4.5.2.1affected
ST Engineering iDirect3315-Series terminals4.5.3.0unaffected
ST Engineering iDirect9-Series Terminals0 <= 4.5.2.1affected
ST Engineering iDirect9-Series Terminals4.5.3.0unaffected

Weaknesses

  • CWE-497: CWE-497

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References