Skip to content
CVE PROGRAM SOURCE RECORD8.6 High

CVE-2026-38058

ST Engineering iDirect iQ-Series Terminals Exposure of Sensitive System Information to an Unauthorized Control Sphere

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
icscert

Description

The endpoint on the iDirect iQ200 VSAT terminal returns the complete device configuration as JSON, including the SECURITY section which contains MD5-crypt password hashes for the root SSH and web administration accounts. Any user with valid web credentials can extract these hashes and crack them offline using commodity hardware.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ST Engineering iDirect Evolution iQ‑Series terminals

Default version status: unaffected

  • 0 to ≤ 4.5.2.1affected
  • 4.5.3.0unaffected

ST Engineering iDirect 3315-Series terminals

Default version status: unaffected

  • 0 to ≤ 4.5.2.1affected
  • 4.5.3.0unaffected

ST Engineering iDirect 9-Series Terminals

Default version status: unaffected

  • 0 to ≤ 4.5.2.1affected
  • 4.5.3.0unaffected

References