CVE-2026-38059

ST Engineering iDirect iQ-Series Terminals Missing authentication for critical function

CVSS 4.0 8.7 HIGHCVSS 3.1 7.5 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-38059

Published

The iDirect iQ200 exposes the /api/identity and /api/ REST API endpoints without authentication. An unauthenticated attacker with network access can retrieve sensitive device information including the serial number, Device ID (DID), Terminal Private Key identifier (TPK), MAC address, and exact firmware version. The DID and TPK are used for satellite network authentication in the iDirect platform, potentially enabling terminal impersonation and network reconnaissance.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-38059

Published

Evolution iQ‑Series terminals

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "ST Engineering iDirect",
                    "product": "Evolution iQ‑Series terminals",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0",
                            "lessThanOrEqual": "4.5.2.1",
                            "versionType": "custom"
                        },
                        {
                            "status": "unaffected",
                            "version": "4.5.3.0"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

3315-Series terminals

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "ST Engineering iDirect",
                    "product": "3315-Series terminals",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0",
                            "lessThanOrEqual": "4.5.2.1",
                            "versionType": "custom"
                        },
                        {
                            "status": "unaffected",
                            "version": "4.5.3.0"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

9-Series Terminals

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "ST Engineering iDirect",
                    "product": "9-Series Terminals",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0",
                            "lessThanOrEqual": "4.5.2.1",
                            "versionType": "custom"
                        },
                        {
                            "status": "unaffected",
                            "version": "4.5.3.0"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON