CVE-2026-38056: iDirect iQ200 VSAT Privilege Escalation

CVE-2026-38056 Overview

CVE-2026-38056 is a local privilege escalation vulnerability in the iDirect iQ200 VSAT (Very Small Aperture Terminal) satellite modem running firmware version 23.0.1.0. The device ships with a pre-configured low-privilege local account intended for field technicians performing maintenance and diagnostics. An attacker leveraging this built-in account can escalate to full administrative control without acquiring additional credentials. The iQ200 serves as the primary communications link for oil and gas platforms, maritime vessels, defense installations, and remote infrastructure, making compromise of the modem a direct threat to operational connectivity.

Critical Impact
An authenticated local user with the shipped low-privilege technician account can escalate privileges to root-equivalent control over the satellite modem, compromising confidentiality, integrity, and availability of the communications link.

Affected Products

iDirect iQ200 VSAT satellite terminal
Firmware version 23.0.1.0
Deployments in oil and gas, maritime, defense, and remote infrastructure environments

Discovery Timeline

2026-09-11 - CVE-2026-38056 published to the National Vulnerability Database
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-38056

Vulnerability Analysis

The iQ200 exposes administrative functionality that is not protected by an authorization check, classified under [CWE-862] Missing Authorization. Field technicians receive a pre-configured shell account for diagnostics but should be constrained from full device administration. The missing authorization boundary allows that account to invoke privileged operations directly. Attackers therefore bypass the intended separation between maintenance access and administrative control. Because the vulnerable component runs on the device itself, exploitation grants control over routing, cryptographic material, configuration, and the satellite link handled by the modem.

Root Cause

The root cause is a missing authorization check on administrative operations reachable from the low-privilege technician shell. The firmware trusts the presence of a valid local session rather than validating the role or privilege level of the caller. This design flaw effectively collapses the two-tier account model into a single privilege level once local access is obtained.

Attack Vector

Exploitation requires local access to the device shell using the factory-supplied technician credentials. No user interaction, no additional authentication, and no exploit chaining are required. Attackers with physical access to a deployed modem, or logical shell access through a management network, can invoke the privileged operations that lack authorization checks. Given the device ships with these credentials, any organization operating the iQ200 without customized account hardening is exposed. Because no verified proof-of-concept has been published, the following description is prose-only: the exploitation path centers on invoking administrative commands or endpoints from within the technician shell that should have been gated by a role check.

// No verified public exploit code is available for CVE-2026-38056.
// See CISA ICS Advisory ICSA-26-183-01 for technical details.

Detection Methods for CVE-2026-38056

Indicators of Compromise

Unexpected shell logins to the iQ200 using the factory-supplied technician account, especially outside scheduled maintenance windows
Configuration changes to routing, satellite link parameters, or credential stores made from a technician session
New or modified local accounts, SSH keys, or cron entries on the modem
Outbound connections from the modem management interface to unknown hosts

Detection Strategies

Forward iQ200 authentication and shell audit logs to a centralized log platform and alert on successful logins by the technician account
Alert on privileged commands or configuration writes originating from sessions bound to the low-privilege account
Baseline expected management traffic to and from the modem and flag deviations

Monitoring Recommendations

Continuously monitor the management VLAN or out-of-band network serving VSAT terminals for anomalous access
Track firmware version and account inventory across the VSAT fleet to identify devices still running 23.0.1.0
Correlate modem activity with change-management tickets so unscheduled technician sessions surface as alerts

How to Mitigate CVE-2026-38056

Immediate Actions Required

Inventory all iQ200 terminals and identify units running firmware 23.0.1.0
Rotate or disable the factory-supplied technician account credentials on every affected device
Restrict shell access to the modem to a dedicated management network with enforced access controls
Contact iDirect through the iDirect Support Portal for remediation guidance and firmware availability

Patch Information

At time of publication, refer to CISA ICS Advisory ICSA-26-183-01 and the CSAF advisory document for authoritative remediation status and vendor-supplied firmware updates. Apply vendor-released firmware as soon as it is validated in a maintenance window.

Workarounds

Disable or password-rotate the pre-configured technician account where operationally feasible
Place the modem management interface on an isolated network reachable only through jump hosts with strong authentication
Enforce physical security controls at remote sites and vessels to prevent console access to the device
Log and review every technician session on the iQ200 until a vendor patch is deployed

bash

# Example: restrict management access to the modem to a jump host
# (adapt to your network appliance syntax)
access-list VSAT_MGMT permit tcp host 10.10.20.5 host 192.0.2.10 eq 22
access-list VSAT_MGMT deny   ip any host 192.0.2.10 log
access-list VSAT_MGMT permit ip any any