CVE-2026-38057: iDirect iQ200 CSRF Vulnerability

CVE-2026-38057 Overview

CVE-2026-38057 is a Cross-Site Request Forgery (CSRF) vulnerability in the iDirect iQ200 satellite modem. The device fails to validate CSRF tokens on state-changing API endpoints after authentication. The /api/reboot endpoint accepts POST requests authenticated solely by a session cookie that lacks the SameSite attribute. A remote attacker can host a malicious web page that, when visited by an authenticated administrator, silently submits a cross-site POST request to force an immediate device reboot. The attack disrupts the satellite link and can be repeated to sustain a denial-of-service condition. The weakness is tracked under CWE-352.

Critical Impact
An authenticated administrator visiting an attacker-controlled page triggers an unauthenticated cross-site reboot of the iQ200 modem, causing satellite link loss and sustained denial of service.

Affected Products

iDirect iQ200 satellite modem
Web management interface exposing /api/reboot
Deployments relying on session-cookie authentication without SameSite protection

Discovery Timeline

2026-07-10 - CVE-2026-38057 published to NVD
2026-07-10 - Last updated in NVD database
2026 - Coordinated disclosure via CISA advisory ICSA-26-183-01

Technical Details for CVE-2026-38057

Vulnerability Analysis

The iQ200 web management API relies on a session cookie as the sole authentication factor for privileged operations. State-changing endpoints such as /api/reboot do not require a per-request CSRF token, custom header, or Origin validation. Because the session cookie is issued without the SameSite attribute, browsers attach it to cross-origin POST requests initiated from any external site. An attacker who lures an authenticated administrator to a malicious page can therefore issue authenticated device commands from that administrator's browser without any interaction beyond page load.

The reboot operation is destructive to availability. Each successful cross-site POST forces the modem to restart, dropping the satellite link during the boot cycle. Repeated triggers extend the outage indefinitely.

Root Cause

The root cause is missing CSRF protection on authenticated state-changing endpoints, compounded by a session cookie that lacks the SameSite=Lax or SameSite=Strict attribute. The server treats cookie presence as sufficient proof of intent, ignoring the request's origin.

Attack Vector

An attacker crafts a web page containing an auto-submitting HTML form or fetch() call targeting the iQ200's /api/reboot endpoint. When an authenticated administrator loads the page, the browser attaches the modem's session cookie and completes the POST. The modem reboots without further validation. The attack requires user interaction with the malicious page but no credentials, no network position on the management LAN beyond the victim's own browser, and no prior compromise of the device.

See the CISA ICS Advisory ICSA-26-183-01 for the vendor-coordinated technical description.

Detection Methods for CVE-2026-38057

Indicators of Compromise

Unexpected POST requests to /api/reboot in modem access logs originating from browser sessions immediately after external referrers.
Repeated reboot events correlated with administrator web browsing activity.
HTTP requests to management endpoints carrying an Origin or Referer header from an external domain.

Detection Strategies

Monitor iQ200 web server logs for POST requests to state-changing endpoints where the Referer or Origin header does not match the management interface hostname.
Alert on reboot events that occur outside scheduled maintenance windows or without corresponding console activity.
Inspect network flows for unexplained satellite link resets that align with modem administrator workstation web traffic.

Monitoring Recommendations

Forward modem syslog and web access logs to a central log platform for retention and correlation.
Baseline normal reboot frequency and alert on deviations.
Track administrator browser session activity relative to management-plane events for anomaly detection.

How to Mitigate CVE-2026-38057

Immediate Actions Required

Restrict access to the iQ200 web management interface to a dedicated management network or jump host.
Require administrators to close all other browser tabs and sessions before authenticating to the modem, or use a separate browser profile exclusively for device management.
Log out of the management UI immediately after each administrative task to invalidate the session cookie.
Consult the iDirect support portal for vendor guidance and firmware updates addressing CVE-2026-38057.

Patch Information

Refer to the CISA ICS Advisory ICSA-26-183-01 and the corresponding CSAF document for authoritative vendor remediation status. Apply firmware updates from iDirect as they become available.

Workarounds

Place the modem management interface behind a VPN or firewall that blocks all inbound HTTP(S) traffic from untrusted networks.
Enforce browser isolation for OT and satellite management workstations, prohibiting general web browsing from hosts used to administer the iQ200.
Deploy a reverse proxy in front of the management UI that enforces Origin header validation and drops cross-site POST requests.
Configure administrator browsers to block third-party cookies and reject cross-site request cookies where possible.

bash

# Example: reverse proxy Origin enforcement (nginx)
location /api/ {
    if ($http_origin !~* ^https://idirect\.internal\.example$) {
        return 403;
    }
    proxy_pass https://iq200.internal.example;
}