ST Engineering iDirect vulnerabilities

Products

• 3315-Series terminals 4
• 9-Series Terminals 4
• Evolution iQ‑Series terminals 4
• evo idx 2
• idx 2

Latest ST Engineering iDirect CVEs

Newest publication first

1. CVE-2026-94216 ST Engineering iDirect iDX/Evo iDX HTTP Request authorize response splitting

   Published 2026-09-21

   Medium·CVSS 5.3 EPSS 0.45%

   A vulnerability was determined in ST Engineering iDirect iDX and Evo iDX. This vulnerability affects unknown code of the file /authorize of the component HTTP Request Handler. Executing a manipulation of the argument Success can lead to http response splitting. It is possible to...

2. CVE-2026-94214 ST Engineering iDirect iDX/Evo iDX Location Header redirect

   Published 2026-09-21

   Medium·CVSS 5.3 EPSS 0.43%

   A vulnerability was found in ST Engineering iDirect iDX and Evo iDX. This affects an unknown part of the component Location Header Handler. Performing a manipulation of the argument Host results in open redirect. It is possible to initiate the attack remotely. The exploit has bee...

3. CVE-2026-38056 ST Engineering iDirect iQ-Series Terminals Missing Authorization

   Published 2026-09-11

   Critical·CVSS 9.4 EPSS 0.15%

   A local privilege escalation vulnerability exists in the iDirect iQ200 VSAT terminal running firmware 23.0.1.0. The iQ200 is a rackmount satellite modem deployed across oil and gas, maritime, defense, and remote infrastructure as the primary, and often sole communications link fo...

4. CVE-2026-38058 ST Engineering iDirect iQ-Series Terminals Exposure of Sensitive System Information to an Unauthorized Control Sphere

   Published 2026-09-11

   High·CVSS 8.6 EPSS 0.46%

   The endpoint on the iDirect iQ200 VSAT terminal returns the complete device configuration as JSON, including the SECURITY section which contains MD5-crypt password hashes for the root SSH and web administration accounts. Any user with valid web credentials can extract these hashe...

5. CVE-2026-38059 ST Engineering iDirect iQ-Series Terminals Missing authentication for critical function

   Published 2026-07-10

   High·CVSS 8.7 EPSS 0.59%

   The iDirect iQ200 exposes the /api/identity and /api/ REST API endpoints without authentication. An unauthenticated attacker with network access can retrieve sensitive device information including the serial number, Device ID (DID), Terminal Private Key identifier (TPK), MAC addr...

6. CVE-2026-38057 ST Engineering iDirect iQ-Series Terminals Cross-Site request forgery

   Published 2026-07-10

   High·CVSS 7.0 EPSS 0.31%

   The iDirect iQ200 does not validate CSRF tokens on state-changing API endpoints after authentication. The /api/reboot endpoint accepts POST requests authenticated solely by a session cookie that lacks the SameSite attribute. A remote attacker can host a malicious web page that, w...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.