CVE-2026-38058: iDirect iQ200 Information Disclosure Flaw

CVE-2026-38058 Overview

CVE-2026-38058 affects the iDirect iQ200 Very Small Aperture Terminal (VSAT), a satellite communications device. An authenticated endpoint returns the complete device configuration as JSON, including a SECURITY section that exposes MD5-crypt password hashes for the root SSH and web administration accounts. Any user holding valid low-privilege web credentials can retrieve these hashes and crack them offline using commodity hardware. The weakness is cataloged as Exposure of Sensitive System Information to an Unauthorized Control Sphere [CWE-497].

Critical Impact
A low-privileged authenticated attacker can extract root SSH and web admin password hashes, then crack them offline to gain full administrative control of the VSAT terminal.

Affected Products

iDirect iQ200 VSAT terminal
Web administration interface exposing the configuration JSON endpoint
Root SSH account sharing the same credential material

Discovery Timeline

2026-09-11 - CVE-2026-38058 published to the National Vulnerability Database
2026-09-18 - Last updated in NVD database
ICSA-26-183-01 - CISA Industrial Control Systems advisory published

Technical Details for CVE-2026-38058

Vulnerability Analysis

The iDirect iQ200 web administration interface exposes an endpoint that serializes the full device configuration into a JSON document. That document includes a SECURITY section holding MD5-crypt hashes for both the root SSH account and the web administration accounts. Authentication to the endpoint requires only valid web credentials, without any privilege gating on the sensitive fields.

MD5-crypt is a legacy password hashing scheme. Modern GPU cracking rigs recover realistic passwords from MD5-crypt hashes at rates measured in millions of guesses per second. Once an attacker obtains the hashes, offline cracking removes any rate limiting, lockout, or logging protection provided by the device itself.

Successful cracking yields the root password, which the same hash covers for SSH access. The attacker gains full shell control of the satellite terminal, enabling traffic interception, configuration tampering, or pivoting into the satellite network segment.

Root Cause

The root cause is an authorization and data-minimization defect. The configuration API returns sensitive credential material to any authenticated web session, regardless of role. Compounding the exposure, the device stores administrative passwords using MD5-crypt, a hashing algorithm that no longer resists offline attack on commodity hardware.

Attack Vector

Exploitation requires network access to the web administration interface and valid low-privileged credentials. The attacker authenticates, requests the configuration JSON, parses out the SECURITY section, and runs the extracted hashes through an offline cracker such as hashcat or john. Recovered credentials are then reused against the SSH service or the web admin console for full administrative access.

No verified proof-of-concept code has been published. See the CISA ICS Advisory ICSA-26-183-01 for the coordinated disclosure details.

Detection Methods for CVE-2026-38058

Indicators of Compromise

Authenticated HTTP requests to the iQ200 configuration export endpoint from non-administrative user accounts or unfamiliar source IPs.
Unexpected SSH logins to the terminal as root following recent web administration activity from the same source.
Configuration changes to the VSAT device that were not initiated by authorized change management workflows.

Detection Strategies

Alert on any web session that requests the full configuration JSON without a corresponding administrative role assignment.
Correlate web admin authentication events with subsequent root SSH logins within a short time window to surface credential reuse after offline cracking.
Monitor for repeated failed and then successful SSH root logins that indicate password guessing derived from cracked hashes.

Monitoring Recommendations

Forward VSAT web and SSH access logs into a central log platform for cross-source correlation.
Baseline expected administrative source IPs and flag deviations, particularly from outside operational management ranges.
Track outbound flows from the iQ200 to detect post-compromise pivoting into internal networks.

How to Mitigate CVE-2026-38058

Immediate Actions Required

Restrict network reachability of the iQ200 web administration and SSH interfaces to a dedicated management VLAN or jump host.
Rotate all root SSH and web administration passwords, assuming existing hashes may already have been exfiltrated.
Audit local web administration accounts, remove unused users, and enforce strong unique passwords resistant to offline cracking.

Patch Information

Refer to the iDirect Support Page for vendor firmware updates addressing CVE-2026-38058 and to the CISA ICS Advisory ICSA-26-183-01 for coordinated remediation guidance. Apply vendor-supplied firmware once available and verify that the SECURITY section is no longer returned to non-privileged sessions.

Workarounds

Place the iQ200 behind a firewall that permits management traffic only from a small allowlist of administrator hosts.
Disable or reduce the number of low-privileged web accounts that can authenticate to the device.
Require multi-factor authentication on the jump hosts used to reach the management interface, reducing the value of any cracked device password.
Enable verbose logging on the terminal and forward events off-device so evidence survives a subsequent root compromise.

bash

# Example: restrict management access via host-based firewall on an upstream gateway
iptables -A FORWARD -p tcp -d <iq200_ip> --dport 443 -s <mgmt_subnet> -j ACCEPT
iptables -A FORWARD -p tcp -d <iq200_ip> --dport 22  -s <mgmt_subnet> -j ACCEPT
iptables -A FORWARD -p tcp -d <iq200_ip> --dport 443 -j DROP
iptables -A FORWARD -p tcp -d <iq200_ip> --dport 22  -j DROP