CVE-2026-38057: falha de alta gravidade em ST Engineering iDirect 3315-Series terminals
ST Engineering iDirect iQ-Series Terminals Cross-Site request forgery
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7epss 0.3%
The iDirect iQ200 does not validate CSRF tokens on state-changing API endpoints after authentication. The /api/reboot endpoint accepts POST requests authenticated solely by a session cookie that lacks the SameSite attribute. A remote attacker can host a malicious web page that, when visited by an authenticated administrator, automatically submits a cross-site POST request causing an immediate device reboot and satellite link loss. Repeated attacks can sustain a denial-of-service condition.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
ST Engineering iDirect · 3315-Series terminalsST Engineering iDirect · 9-Series TerminalsST Engineering iDirect · Evolution iQ‑Series terminalsCVEs relacionadas — ST Engineering iDirect 3315-Series terminals
No mesmo produto, das mais perigosas para as menos.
CVE-2026-38059HIGHST Engineering iDirect iQ-Series Terminals Missing authentication for critical functionEPSS 0.6%CVE-2026-38058HIGHST Engineering iDirect iQ-Series Terminals Exposure of Sensitive System Information to an Unauthorized Control SphereEPSS 0.5%CVE-2026-38056CRITICALST Engineering iDirect iQ-Series Terminals Missing AuthorizationEPSS 0.2%