# ST Engineering iDirect Satellite Terminals Exposed: Critical Unauthenticated API Access and DoS Vulnerabilities Threaten Global Infrastructure
## The Threat
ST Engineering iDirect has disclosed two critical vulnerabilities in its iQ-Series satellite terminal lineup that expose sensitive device credentials and enable denial-of-service attacks. The flaws—tracked as CVE-2026-38059 and CVE-2026-38057—affect multiple terminal models deployed across communications, energy, defense, and transportation sectors worldwide.
CVE-2026-38059 is a missing authentication vulnerability that exposes the /api/identity and /api/ REST API endpoints without requiring any credentials. An unauthenticated attacker with network access can retrieve sensitive device information including the terminal's serial number, Device ID (DID), Terminal Private Key identifier (TPK), MAC address, and exact firmware version. The DID and TPK are authentication credentials used within the iDirect satellite platform; their exposure could enable an attacker to impersonate a legitimate terminal, conduct network reconnaissance, or forge satellite authentication tokens.
CVE-2026-38057 compounds the risk by allowing cross-site request forgery (CSRF) attacks on the /api/reboot endpoint. An authenticated session cookie lacks the SameSite attribute, enabling a remote attacker to host a malicious web page that, when visited by an authenticated administrator, automatically submits a reboot command. The attack triggers an immediate satellite link loss and can be repeated to sustain a prolonged denial-of-service condition. For operators managing critical infrastructure, repeated terminal restarts disrupt service availability and create operational chaos.
Together, these vulnerabilities reflect a pattern of satellite and space-based infrastructure being inadequately secured against remote attackers—and increasingly, they're being discovered after years of deployment.
## Severity and Impact
| CVE ID | CWE | CVSS v3.1 | CVSS v4.0 | Vector (v3.1) | Attack Vector | Authentication | User Interaction |
|---|---|---|---|---|---|---|---|
| CVE-2026-38059 | CWE-306 | 7.5 (HIGH) | 8.7 (HIGH) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | Network | None | None |
| CVE-2026-38057 | CWE-352 | — | — | Cross-Site Request Forgery | Network | Session cookie (SameSite not enforced) | Yes (admin visits malicious page) |
Both vulnerabilities require only network access; no prior authentication is needed for CVE-2026-38059, and CVE-2026-38057 exploits a design flaw in session handling that makes admin credentials trivial to abuse via CSRF.
## Affected Products
ST Engineering iDirect has confirmed vulnerability in the following terminal models and versions:
Deployments span communications carriers, defense contractors, energy utilities, government agencies, and transportation operators worldwide. Organizations should verify their terminal firmware versions immediately via device management interfaces or contact their iDirect support representative.
## Mitigations
Immediate Actions:
1. Apply the patch: ST Engineering iDirect has released version 4.5.2.2 and newer to remediate both vulnerabilities. Registered users can download updates via the [iDirect Support Portal](https://support.idirect.net/s/login). Prioritize terminals in critical environments.
2. Restrict management API access: Limit access to administrative APIs and management interfaces to trusted networks only using virtual private networks (VPNs), access control lists (ACLs), or firewall rules. Do not expose administrative endpoints to the public internet.
3. Enforce strong authentication: Implement multi-factor authentication (MFA) for administrator accounts that can access terminal management interfaces. Rotate session cookies and enforce the SameSite=Strict attribute on all authentication cookies.
4. Monitor for anomalous activity: Enable logging for API access patterns. Alert on:
- Requests to /api/identity or /api/ endpoints from unexpected sources
- POST requests to /api/reboot outside of scheduled maintenance windows
- Unusual firmware version queries or credential lookups
- Unexpected device reboots or satellite link failures
5. Segment satellite terminals: Isolate iDirect terminals from general corporate networks. Use dedicated network segments with strict ingress/egress filtering.
## References
---
## HackWire Analysis
These vulnerabilities expose a troubling pattern in satellite and space-based infrastructure security: critical systems are often designed with the assumption they operate in a "trusted" environment, then deployed into contested networks where that assumption collapses instantly.
The exposure of the Terminal Private Key identifier (TPK) is particularly concerning because satellite operators have historically treated satellite terminals as non-internet-facing devices—a reasonable assumption in the 1990s, but dangerously obsolete today. Attackers who capture a TPK can potentially forge or replay authentication to the satellite network, impersonating legitimate terminals. For military or intelligence users, this is a direct threat to operational security.
The CSRF vulnerability on the reboot endpoint highlights a second red flag: the API was clearly bolted onto an older system without modern CSRF protections. The missing SameSite cookie attribute suggests this code predates widespread adoption of CSRF defenses (circa 2017+), yet it's still running on production terminals in 2026.
What makes this particularly urgent: satellite terminals often operate in remote or mission-critical locations where physical access to trigger manual reboots is either impossible or extremely expensive. A sustained DoS attack that repeatedly forces reboots isn't a nuisance—it's a potential mission kill. Operators in defense, energy distribution, or emergency services should treat these patches as top priority, not follow standard update cycles.
The fix exists and is available, but organizations with dozens or hundreds of deployed terminals face a real operational burden patching them. ST Engineering iDirect should provide automated deployment tools or work with integrators to accelerate rollout. Until then, the manual network segmentation and monitoring recommendations are not optional.
— HackWire Editorial
---
## Related Coverage