CVE-2026-38059: iDirect iQ200 Information Disclosure Flaw

CVE-2026-38059 Overview

CVE-2026-38059 affects the iDirect iQ200 satellite terminal, which exposes the /api/identity and /api/ REST API endpoints without authentication. An unauthenticated attacker with network access can retrieve sensitive device information including the serial number, Device ID (DID), Terminal Private Key identifier (TPK), MAC address, and firmware version. The DID and TPK are used for satellite network authentication in the iDirect platform. Exposure of these identifiers enables terminal impersonation and network reconnaissance against operational satellite communications infrastructure. The vulnerability is classified under CWE-306: Missing Authentication for Critical Function.

Critical Impact
Unauthenticated network attackers can extract terminal identity credentials (DID, TPK, serial, MAC) used for satellite network authentication, enabling terminal impersonation and reconnaissance of iDirect satellite deployments.

Affected Products

iDirect iQ200 satellite terminal
iDirect satellite network platform (terminals relying on DID/TPK authentication)
Operational technology (OT) environments using iQ200 for VSAT connectivity

Discovery Timeline

2026-07-10 - CVE-2026-38059 published to NVD
2026-07-10 - Last updated in NVD database
ICSA-26-183-01 - CISA ICS advisory released

Technical Details for CVE-2026-38059

Vulnerability Analysis

The iDirect iQ200 exposes two REST API endpoints, /api/identity and /api/, without any authentication or authorization controls. Any client that can reach the terminal on the network can query these endpoints and receive detailed device information in the response. The exposed data includes the device serial number, Device ID (DID), Terminal Private Key identifier (TPK), MAC address, and exact firmware version.

The DID and TPK identifiers are not intended to be public. They are used by the iDirect platform to authenticate terminals to the satellite network. Disclosure to unauthenticated clients breaks the trust model for terminal identity and allows attackers to enumerate deployed hardware across a network segment.

The firmware version disclosure compounds the risk. An attacker can map exact firmware builds to known vulnerabilities and target further exploitation. Combined with the MAC address and serial number, an attacker can build a complete asset inventory of exposed iQ200 terminals without triggering authentication logs.

Root Cause

The root cause is missing authentication on critical REST endpoints [CWE-306]. The API handlers for /api/identity and /api/ do not enforce identity verification before returning sensitive device attributes. This is a design flaw rather than an implementation bug.

Attack Vector

Exploitation requires only network reachability to the terminal's management interface. An attacker sends an HTTP GET request to /api/identity or /api/ and parses the response. No credentials, tokens, or user interaction are required. In deployments where the iQ200 management interface is reachable from untrusted networks, exploitation is trivial.

No verified public proof-of-concept code is available. The vulnerability mechanism is described in the CISA ICS Advisory ICSA-26-183-01 and the associated GitHub CSAF Document.

Detection Methods for CVE-2026-38059

Indicators of Compromise

Unauthenticated HTTP GET requests to /api/identity or /api/ on iQ200 terminals from unexpected source addresses.
Repeated API queries from a single source enumerating multiple terminal IPs across a management subnet.
Outbound traffic from iQ200 management interfaces to hosts that previously queried these endpoints.

Detection Strategies

Deploy network intrusion detection signatures that alert on HTTP requests matching the /api/identity path against iQ200 management IP ranges.
Baseline legitimate management traffic to the iQ200 web interface and alert on requests originating outside the management VLAN.
Correlate HTTP 200 responses from /api/identity with subsequent authentication attempts on the satellite network side.

Monitoring Recommendations

Log all HTTP requests to iQ200 management interfaces at the network edge or upstream firewall.
Monitor for scanning behavior against TCP ports serving the terminal's web API.
Track firmware version and DID/TPK values reported in network telemetry to detect unauthorized disclosure.

How to Mitigate CVE-2026-38059

Immediate Actions Required

Restrict network access to the iQ200 management interface using firewall rules or ACLs that permit only authorized management hosts.
Place iQ200 terminals on isolated management VLANs that are not routable from user or internet-facing networks.
Audit exposure by scanning for reachable /api/identity endpoints across the environment and confirm each is protected.

Patch Information

No vendor patch has been referenced in the NVD entry at time of publication. Consult the iDirect Support portal for the latest firmware advisories and the CISA ICS Advisory ICSA-26-183-01 for authoritative vendor guidance.

Workarounds

Block inbound access to the iQ200 HTTP management interface at the perimeter and permit only jump hosts under administrative control.
Segment satellite terminal management traffic from operational traffic and enforce strict egress filtering.
Rotate any credentials or shared secrets associated with terminals whose DID/TPK values may have been exposed, in coordination with the network operator.

bash

# Example iptables rule restricting access to the iQ200 management API
# Replace <MGMT_HOST> with your authorized management workstation IP
# and <IQ200_IP> with the terminal management address
iptables -A INPUT -p tcp -d <IQ200_IP> --dport 80 -s <MGMT_HOST> -j ACCEPT
iptables -A INPUT -p tcp -d <IQ200_IP> --dport 80 -j DROP
iptables -A INPUT -p tcp -d <IQ200_IP> --dport 443 -s <MGMT_HOST> -j ACCEPT
iptables -A INPUT -p tcp -d <IQ200_IP> --dport 443 -j DROP