CVE-2026-38057 Details

A cross-site request forgery (CSRF) vulnerability has been identified in the ST Engineering iDirect iQ200 terminals, specifically in versions through 4.5.2.1. The vulnerability arises because the device does not properly validate CSRF tokens on state-changing API endpoints after authentication. The issue is present in the '/api/reboot' endpoint, which accepts POST requests authenticated only by a session cookie that lacks the SameSite attribute. This flaw allows remote attackers to host malicious web pages that, when visited by authenticated administrators, automatically send cross-site POST requests. Such actions can trigger an immediate device reboot, causing a loss of satellite link connectivity. Furthermore, repeated exploitation can create a sustained denial-of-service condition.

Users are advised to update the software to version 4.5.2.2 or newer. Patches are available for download from the iDirect Support Portal. Additionally, management interfaces should be restricted to trusted networks, administrative APIs should not be exposed to the public internet, and strong authentication practices should be enforced. Monitoring for unusual API activity and unexpected device reboots is also recommended.