CVE-2026-38058
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
ST Engineering iDirect iQ-Series Terminals Exposure of Sensitive System Information to an Unauthorized Control Sphere
The endpoint on the iDirect iQ200 VSAT terminal returns the complete device configuration as JSON, including the SECURITY section which contains MD5-crypt password hashes for the root SSH and web administration accounts. Any user with valid web credentials can extract these hashes and crack them offline using commodity hardware.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Evolution iQ‑Series terminals
- Vendor
- ST Engineering iDirect
- Product
- Evolution iQ‑Series terminals
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0 | affected | custom | Unavailable | 4.5.2.1 | None listed |
| 4.5.3.0 | unaffected | Unavailable | Unavailable | Unavailable | None listed |
3315-Series terminals
- Vendor
- ST Engineering iDirect
- Product
- 3315-Series terminals
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0 | affected | custom | Unavailable | 4.5.2.1 | None listed |
| 4.5.3.0 | unaffected | Unavailable | Unavailable | Unavailable | None listed |
9-Series Terminals
- Vendor
- ST Engineering iDirect
- Product
- 9-Series Terminals
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0 | affected | custom | Unavailable | 4.5.2.1 | None listed |
| 4.5.3.0 | unaffected | Unavailable | Unavailable | Unavailable | None listed |