High 7.5Published Jul 10, 2026

CVE-2026-38059ST Engineering iDirect iQ-Series Terminals Missing authentication for critical function

Updated under an hour ago (Oct 28, 2026, 1:50 AM ET)

Does this affect you?

It affects ST Engineering iDirect Evolution iQ‑Series terminals and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for ST Engineering iDirect Evolution iQ‑Series terminals

Exploited in the last 30 days

The iDirect iQ200 exposes the /api/identity and /api/ REST API endpoints without authentication. An unauthenticated attacker with network access can retrieve sensitive device information including the serial number, Device ID (DID), Terminal Private Key identifier (TPK), MAC address, and exact firmware version. The DID and TPK are used for satellite network authentication in the iDirect platform, potentially enabling terminal impersonation and network reconnaissance.

CVSS: 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness (CWE): CWE-306
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: icscert
NVD analysis: Awaiting Analysis
Record last updated: Sep 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

ST Engineering iDirect Evolution iQ‑Series terminals st_engineering_idirect:evolution_iq_series_terminals (from the name)	through 4.5.2.1; 4.5.3.0 not affected	CNA record
ST Engineering iDirect 3315-Series terminals st_engineering_idirect:3315_series_terminals (from the name)	through 4.5.2.1; 4.5.3.0 not affected	CNA record
ST Engineering iDirect 9-Series Terminals st_engineering_idirect:9_series_terminals (from the name)	through 4.5.2.1; 4.5.3.0 not affected	CNA record

References

References

https://support.idirect.net
https://www.cisa.gov/news-events/ics-advisories/icsa-26-183-01
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-183-01.json

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.