CVE-2026-38059 ST Engineering iDirect CVE debrief

Who should care

Defenders responsible for iDirect iQ200 devices, satellite network administrators, and security teams should assess exposure and prioritize verification and remediation efforts. They should verify exposed devices, check for unauthorized access, and ensure firmware versions are up-to-date. Additionally, they should review compensating controls for exposed systems while remediation is scheduled and verified, and track exceptions, retest remediated assets,

Why it matters

CVE-2026-38059 exposes sensitive information on iDirect iQ200 devices, potentially enabling terminal impersonation and network reconnaissance. Defenders should verify exposed devices, check for unauthorized access, and ensure firmware versions are up-to-date.

• Potential terminal impersonation and network reconnaissance
• Unauthorized access to sensitive device information
• Possible exploitation for further attacks on satellite networks
• Verification of device firmware versions and configurations

Technical summary

The iDirect iQ200 device exposes unauthenticated API endpoints, allowing attackers to retrieve sensitive device information, including serial number, Device ID (DID), Terminal Private Key identifier (TPK), MAC address, and firmware version. This exposure could potentially enable terminal impersonation and network reconnaissance. The device's API endpoints are accessible without authentication, making it crucial for defenders to verify exposed devices and ensure firmware versions are up-to-date. The vulnerability's High severity and CVSS score of 8.7 emphasize the need for immediate attention and remediation.

Defensive priority

Defenders should prioritize verifying exposed iDirect iQ200 devices, checking for unauthorized access, and ensuring firmware versions are up-to-date.

Recommended defensive actions

• Verify and restrict access to iDirect iQ200 API endpoints
• Check for unauthorized access and sensitive information disclosure
• Ensure firmware versions are up-to-date and review for potential vulnerabilities
• Monitor device logs for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the exposed API endpoints and potential impact. However, additional information on affected versions, exploitation, and remediation is limited. Defenders should verify exposed devices, check for unauthorized access, and ensure firmware versions are up-to-date. The lack of specific details on affected versions and exploitation methods requires a cautious approach, focusing on immediate verification and potential mitigation strategies.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.