Evolution iQ‑Series terminals vulnerabilities

4 known vulnerabilities in Evolution iQ‑Series terminals from ST Engineering iDirect. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  Evolution iQ‑Series terminals: Exposure of Sensitive System Information to an Unauthorized Control Sphere

  CVE-2026-38058Sep 11, 2026ST Engineering iDirect

  The endpoint on the iDirect iQ200 VSAT terminal returns the complete device configuration as JSON, including the SECURITY section which contains MD5-crypt password hashes for the root SSH and web administration accounts. Any user with valid web credentials can

• 8.8 High severity

  Evolution iQ‑Series terminals: Missing Authorization

  CVE-2026-38056Sep 11, 2026ST Engineering iDirect

  A local privilege escalation vulnerability exists in the iDirect iQ200 VSAT terminal running firmware 23.0.1.0. The iQ200 is a rackmount satellite modem deployed across oil and gas, maritime, defense, and remote infrastructure as the primary, and often sole co

• 7.5 High severity

  Evolution iQ‑Series terminals: Missing Authentication for Critical Functionality

  CVE-2026-38059Jul 10, 2026ST Engineering iDirect

  The iDirect iQ200 exposes the /api/identity and /api/ REST API endpoints without authentication. An unauthenticated attacker with network access can retrieve sensitive device information including the serial number, Device ID (DID), Terminal Private Key identi

• 8.1 High severity

  Evolution iQ‑Series terminals: Cross-Site Request Forgery

  CVE-2026-38057Jul 10, 2026ST Engineering iDirect

  The iDirect iQ200 does not validate CSRF tokens on state-changing API endpoints after authentication. The /api/reboot endpoint accepts POST requests authenticated solely by a session cookie that lacks the SameSite attribute. A remote attacker can host a malici