CVE-2026-38058: St Engineering Idirect 3315-Series Terminals

High severity, CVSS 8.1. EPSS: 0.5% chance of exploitation in the next 30 days.

The endpoint on the iDirect iQ200 VSAT terminal returns the complete device configuration as JSON, including the SECURITY section which contains MD5-crypt password hashes for the root SSH and web administration accounts. Any user with valid web credentials can extract these hashes and crack them offline using commodity hardware.

Affected products

• St Engineering Idirect 3315-Series Terminals: up to and including 4.5.2.1
• St Engineering Idirect 9-Series Terminals: up to and including 4.5.2.1
• St Engineering Idirect Evolution Iq‑series Terminals: up to and including 4.5.2.1

Published 2026-09-11. Last modified 2026-09-18.