CVE-2026-38057: iDirect iQ200 CSRF Vulnerability Enables Remote Reboot & DoS

Technical summary

CVE-2026-38057 is a CSRF vulnerability in the iDirect iQ200's REST API. The /api/reboot endpoint accepts state-changing POST requests authenticated solely via a session cookie without the SameSite attribute, and does not validate CSRF tokens. An attacker can craft a malicious page that, when loaded by an authenticated user, automatically submits a forged POST request to /api/reboot. The device lacks the controls necessary to distinguish legitimate user-initiated requests from cross-origin forgeries, enabling unauthorized administrative actions.

Business impact

Satellite communication infrastructure relying on iQ200 devices faces elevated risk of unplanned service outages. Administrators could unknowingly trigger device reboots, causing immediate satellite link loss and service interruption. For organizations operating time-sensitive satellite uplinks (maritime, aviation, remote operations), even brief outages pose operational and safety risks. Repeated exploitation can sustain a denial-of-service state, degrading availability and confidence in the network.

Affected systems

iDirect iQ200 devices are affected. The vulnerability applies to instances where administrators with active sessions access untrusted web content. Organizations should verify which endpoints and firmware versions are deployed in their environment and whether administrative users are exposed to untrusted internet content during active sessions.

Exploitability

Exploitation requires low complexity: an attacker needs only to host a malicious webpage and wait for an authenticated administrator to visit it. No special network position or user interaction beyond visiting a website is required. The CVSS score of 8.1 (HIGH) reflects the combination of network accessibility, low attack complexity, and high impact on integrity and availability. However, the attack does require the victim to be authenticated and to visit a malicious site, reducing the likelihood of opportunistic mass exploitation.

Remediation

Apply a security patch from the vendor that adds CSRF token validation to the /api/reboot and other state-changing endpoints. The patch should also ensure session cookies are set with the SameSite attribute (Strict or Lax recommended) to prevent cross-origin cookie transmission. Verify the patch version against the vendor advisory. In the interim, restrict administrative access to trusted networks and educate administrators about the risks of visiting untrusted websites during active sessions.

Patch guidance

Consult the iDirect vendor advisory for the specific patch version and deployment steps. The fix should address both CSRF token validation on /api/reboot and related endpoints, as well as session cookie configuration. Apply patches to all iQ200 devices in production, prioritizing those exposed to untrusted network access. Test patches in a non-production environment before full deployment to confirm compatibility and operational stability.

Detection guidance

Monitor API logs for POST requests to /api/reboot and other state-changing endpoints that lack valid CSRF tokens or originate from unusual referrers. Review session cookie attributes in responses to confirm SameSite is set correctly. Implement network-level monitoring to detect repeated reboot commands in short timeframes, which may indicate sustained exploitation attempts. Security teams should also audit administrative user activity logs to identify unexpected device reboots.

Why prioritize this

This vulnerability merits prioritized patching because it enables remote denial-of-service against critical satellite infrastructure with minimal attack effort. The combination of HIGH CVSS severity, lack of KEV designation (suggesting it is not yet widely exploited in the wild), and the operational criticality of satellite devices creates a narrow window for remediation before adoption by adversaries. Organizations should address this before the vulnerability matures in attacker toolkits.

Risk score, explained

CVSS 3.1 score of 8.1 (HIGH) reflects: network accessibility (AV:N), low attack complexity (AC:L), no privileges required (PR:N), requirement for user interaction (UI:R), no scope change (S:U), no confidentiality impact (C:N), high integrity impact (I:H) from arbitrary administrative actions, and high availability impact (A:H) from forced reboots. The UI:R factor moderates an otherwise critical score; however, the attack remains highly effective against targeted administrators and is straightforward to automate.

Frequently asked questions