CVE-2026-38059: iDirect iQ200 Unauthenticated API Exposes Satellite Terminal Credentials

Technical summary

CVE-2026-38059 affects the iDirect iQ200 by exposing the /api/identity and /api/ REST API endpoints without authentication controls (CWE-306: Missing Authentication for Critical Function). An attacker with network-layer access to the device can issue HTTP requests to these endpoints and receive responses containing: device serial number, Device ID (DID), Terminal Private Key identifier (TPK), MAC address, and exact firmware version. The DID and TPK are authentication credentials used within the iDirect satellite network architecture, making their disclosure a stepping stone toward terminal impersonation or lateral movement within the satellite operator's infrastructure.

Business impact

Compromise of DID and TPK identifiers enables terminal impersonation, potentially allowing an attacker to conduct unauthorized satellite communications, access network services, or inject malicious data into the satellite operator's uplink/downlink channels. The reconnaissance data (firmware version, serial number) facilitates targeted attacks and supply chain intelligence. For satellite operators, this creates both immediate integrity risks (unauthorized terminal behavior) and medium-term availability risks if attackers pivot further into the network management infrastructure.

Affected systems

iDirect iQ200 terminals are affected. iDirect equipment is commonly deployed in enterprise satellite communications, remote site connectivity, maritime vessel communications, and critical infrastructure where traditional terrestrial networks are unavailable or serve as backup. Organizations using iQ200 terminals for WAN acceleration, disaster recovery, or primary connectivity in remote locations should prioritize inventory and assessment.

Exploitability

The vulnerability has a CVSS 3.1 score of 7.5 (HIGH). Exploitation requires only network access to the device—no user interaction, no authentication, and minimal complexity. An attacker on the same network segment or with routable IP access to the terminal can immediately retrieve sensitive identifiers. No exploit code or zero-day sophistication is required; standard HTTP clients suffice. The primary constraint is network proximity; terminals behind restrictive firewalls or air-gapped from untrusted networks face lower immediate risk.

Remediation

Mitigation prioritizes immediate network segmentation: restrict access to iQ200 management and API endpoints to authorized administrative networks using firewall rules or network ACLs. Reduce the attack surface by disabling unnecessary API endpoints if iDirect provides that configuration option. Monitor for and apply vendor security patches or firmware updates as iDirect releases them—verify patch availability directly through the vendor's official advisory channels. For sensitive deployments, consider implementing additional API gateway authentication or VPN-based access controls to the terminal.

Patch guidance

Check iDirect's official security advisory and product update portal for patched firmware versions addressing CVE-2026-38059. Verify the exact firmware version of affected iQ200 terminals using device management interfaces, then cross-reference against the vendor's patch compatibility matrix. Deploy patches in a staged manner, testing in a non-production environment first, as firmware updates on satellite terminals may require downtime coordination with the service provider. Confirm post-update that the /api/identity and /api/ endpoints are no longer accessible without authentication.

Detection guidance

Monitor network traffic for unauthenticated HTTP requests to /api/identity and /api/ endpoints on iQ200 device IP addresses. Log and alert on successful responses from these endpoints originating from unexpected source IPs. Check device access logs and any centralized syslog aggregation for authentication-bypass attempts or unusual API queries. Scan your network for iQ200 devices (often identifiable by manufacturer signatures and satellite modem port behaviors) and verify that API endpoints require proper authentication headers. SIEM rules correlating access to /api/ without subsequent authentication success are valuable for early detection.

Why prioritize this

HIGH severity (CVSS 7.5) with zero authentication barriers and access to cryptographic identifiers used for satellite terminal authentication justifies immediate attention. The vulnerability requires no user interaction and can be exploited with simple network access; organizations with internet-facing or insufficiently segmented iQ200 terminals face near-term compromise risk. Satellite network credentials are difficult to rotate at scale, making early remediation critical to prevent persistent unauthorized access.

Risk score, explained

CVSS 3.1 score of 7.5 reflects high confidentiality impact (credentials and identifiers disclosed), zero integrity or availability impact in the immediate attack, and a network attack vector with low complexity and no privilege requirements. The score does not diminish the practical risk; disclosure of DID and TPK enables secondary attacks (terminal impersonation, network injection) that could elevate impact to availability and integrity. Organizations should treat this as a precursor to more damaging compromise.

Frequently asked questions