Description
The iDirect iQ200 does not validate CSRF tokens on state-changing API endpoints after authentication. The /api/reboot endpoint accepts POST requests authenticated solely by a session cookie that lacks the SameSite attribute. A remote attacker can host a malicious web page that, when visited by an authenticated administrator, automatically submits a cross-site POST request causing an immediate device reboot and satellite link loss. Repeated attacks can sustain a denial-of-service condition.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
ST Engineering iDirect Evolution iQ‑Series terminals
Default version status: unaffected
0 to ≤ 4.5.2.1affected4.5.3.0unaffected
ST Engineering iDirect 3315-Series terminals
Default version status: unaffected
0 to ≤ 4.5.2.1affected4.5.3.0unaffected
ST Engineering iDirect 9-Series Terminals
Default version status: unaffected
0 to ≤ 4.5.2.1affected4.5.3.0unaffected