High severity · published Sep 11, 2026
CVE-2026-38058
ST Engineering iDirect iQ-Series Terminals Exposure of Sensitive System Information to an Unauthorized Control Sphere
8.1
CVSS
0.5%
EPSS
No
On KEV
Description
The endpoint on the iDirect iQ200 VSAT terminal returns the complete device configuration as JSON, including the SECURITY section which contains MD5-crypt password hashes for the root SSH and web administration accounts. Any user with valid web credentials can extract these hashes and crack them offline using commodity hardware.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
3T
3315-Series terminals · ST Engineering iDirect
through 4.5.2.1 · source: vendor
9T
9-Series Terminals · ST Engineering iDirect
through 4.5.2.1 · source: vendor
EI
Evolution iQ‑Series terminals · ST Engineering iDirect
through 4.5.2.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-38058
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-38058
github.com
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-183-01.json
support.idirect.net
https://support.idirect.net
www.cisa.gov
https://www.cisa.gov/news-events/ics-advisories/icsa-26-183-01
More from 3315-Series terminals
8.8
CVE-2026-38056
ST Engineering iDirect iQ-Series Terminals Missing Authorization
8.1
CVE-2026-38057
ST Engineering iDirect iQ-Series Terminals Cross-Site request forgery
7.5
CVE-2026-38059
ST Engineering iDirect iQ-Series Terminals Missing authentication for critical function