CVE-2026-38059 Details

A vulnerability exists in ST Engineering iDirect iQ-Series terminals, specifically in the Evolution, 3315-Series, and 9-Series models, all running version 4.5.2.1 or earlier. The issue arises from the /api/identity and /api/ REST API endpoints being exposed without authentication. This flaw allows an unauthenticated attacker with network access to retrieve sensitive device information, including the serial number, Device ID (DID), Terminal Private Key identifier (TPK), MAC address, and exact firmware version. The DID and TPK are used for satellite network authentication on the iDirect platform, potentially enabling terminal impersonation and network reconnaissance.

Users are advised to update the software to version 4.5.2.2 or newer. Patches are available for download from the iDirect Support Portal. Additionally, management interfaces should be restricted to trusted networks, avoid exposing administrative APIs to the public internet, and strong authentication practices should be enforced. Organizations should monitor for unusual API activity and unexpected device reboots.