CISA warns iDirect iQ-Series flaws expose satellite authentication credentials

CISA's advisory on ST Engineering iDirect iQ-Series terminals is a patch-now item for operators that put satellite management interfaces anywhere an attacker can reach them. The affected Evolution iQ, 3315 and 9-Series terminals, on version 4.5.2.1 and earlier, have two high-severity flaws: missing authentication on API endpoints and cross-site request forgery on state-changing requests. ST Engineering iDirect has fixed both in version 4.5.2.2.

CVE-2026-38059 should get the faster inventory check. The exposed /api/identity and /api/ REST endpoints can return serial number, Device ID, Terminal Private Key identifier, MAC address and firmware version to an unauthenticated attacker with network access. CISA says the DID and TPK are used for satellite network authentication, which moves the issue beyond ordinary information disclosure into possible terminal impersonation and satellite network reconnaissance.

CVE-2026-38057 is the availability play. The /api/reboot endpoint accepts POST requests authenticated only by a session cookie that lacks the SameSite attribute, so a malicious page visited by an authenticated administrator can submit the reboot request and cause satellite link loss. Repeating that flow can sustain a denial-of-service condition. It is less exotic than credential extraction, but still material when the terminal carries operational traffic or a backup communications path.

For Defense Industrial Base contractors, state CISOs and critical infrastructure operators, the Monday work is narrow and concrete: identify iDirect iQ-Series terminals, confirm firmware, move to version 4.5.2.2 or newer, and keep management APIs off public and untrusted networks. CISA says it has no reports of known public exploitation targeting these vulnerabilities. That is useful comfort. It does not answer the deployment question for networks where an attacker may already have the network access this advisory assumes.