ST Engineering iDirect vulnerabilities
We track 4 vulnerabilities in ST Engineering iDirect products across 3 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on September 11, 2026.
Latest ST Engineering iDirect vulnerabilities
- 8.1 High severity
Evolution iQ‑Series terminals: Exposure of Sensitive System Information to an Unauthorized Control Sphere
The endpoint on the iDirect iQ200 VSAT terminal returns the complete device configuration as JSON, including the SECURITY section which contains MD5-crypt password hashes for the root SSH and web administration accounts. Any user with valid web credentials can
- 8.8 High severity
Evolution iQ‑Series terminals: Missing Authorization
A local privilege escalation vulnerability exists in the iDirect iQ200 VSAT terminal running firmware 23.0.1.0. The iQ200 is a rackmount satellite modem deployed across oil and gas, maritime, defense, and remote infrastructure as the primary, and often sole co
- 7.5 High severity
Evolution iQ‑Series terminals: Missing Authentication for Critical Functionality
The iDirect iQ200 exposes the /api/identity and /api/ REST API endpoints without authentication. An unauthenticated attacker with network access can retrieve sensitive device information including the serial number, Device ID (DID), Terminal Private Key identi
- 8.1 High severity
Evolution iQ‑Series terminals: Cross-Site Request Forgery
The iDirect iQ200 does not validate CSRF tokens on state-changing API endpoints after authentication. The /api/reboot endpoint accepts POST requests authenticated solely by a session cookie that lacks the SameSite attribute. A remote attacker can host a malici