ST Engineering iDirect Evolution iQ-Series terminals up to 4.5.2.1 privileges management

Summaryinfo

A vulnerability was found in ST Engineering iDirect Evolution iQ-Series terminals, 3315-Series terminals and 9-Series Terminals up to 4.5.2.1. It has been rated as very critical. Impacted is an unknown function. This manipulation causes privileges management. This vulnerability is handled as CVE-2026-38056. It is possible to launch the attack on the local host. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in ST Engineering iDirect Evolution iQ-Series terminals, 3315-Series terminals and 9-Series Terminals up to 4.5.2.1. It has been declared as very critical. Affected by this vulnerability is an unknown function. The manipulation with an unknown input leads to a privileges management vulnerability. The CWE definition for the vulnerability is CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

A local privilege escalation vulnerability exists in the iDirect iQ200 VSAT terminal running firmware 23.0.1.0. The iQ200 is a rackmount satellite modem deployed across oil and gas, maritime, defense, and remote infrastructure as the primary, and often sole communications link for offshore rigs, vessels, and remote sites. Important context: the device ships from the factory with a pre-configured low-privilege local user account. This account is intended for field technicians who need shell access for maintenance and diagnostics but should not have full administrative control over the device. This built-in account provides the initial access required to exploit this vulnerability. No additional credentials need to be obtained or brute-forced.

It is possible to read the advisory at support.idirect.net. This vulnerability is known as CVE-2026-38056 since 04/06/2026. The exploitation appears to be easy. Attacking locally is a requirement. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/11/2026). The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

Upgrading to version 4.5.3.0 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• ST Engineering iDirect

Name

• 9-Series Terminals
• 3315-Series terminals
• Evolution iQ-Series terminals

Version

• 4.5.2.0
• 4.5.2.1

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion