{"id":"CVE-2026-38057","title":"ST Engineering iDirect iQ-Series Terminals Cross-Site request forgery","summary":"The iDirect iQ200 does not validate CSRF tokens on state-changing API endpoints after authentication. The /api/reboot endpoint accepts POST requests authenticated solely by a session cookie that lacks the SameSite attribute. A remote att…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","cvssSource":"cna","cwe":["CWE-352"],"vendor":"ST Engineering iDirect","product":"Evolution iQ‑Series terminals","affected":["evolution_iq_series_terminals <= 4.5.2.1","3315-series_terminals <= 4.5.2.1","9-series_terminals <= 4.5.2.1"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-07-10T16:22:04.408644Z"},"published":"2026-07-10","updated":"2026-09-11","sourceUpdated":"2026-09-11T14:41:03.950Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-38057","references":[{"url":"https://support.idirect.net"},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-183-01"},{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-183-01.json"}],"tags":["cve.org"],"epss":0.00313,"epssPercentile":0.2169,"ingestedAt":"2026-09-11T18:53:56.566Z","slug":"CVE-2026-38057","body":"## Overview\n\nThe iDirect iQ200 does not validate CSRF tokens on state-changing API endpoints after authentication. The /api/reboot endpoint accepts POST requests authenticated solely by a session cookie that lacks the SameSite attribute. A remote attacker can host a malicious web page that, when visited by an authenticated administrator, automatically submits a cross-site POST request causing an immediate device reboot and satellite link loss. Repeated attacks can sustain a denial-of-service condition.\n\n## Affected\n\n- `evolution_iq_series_terminals <= 4.5.2.1`\n- `3315-series_terminals <= 4.5.2.1`\n- `9-series_terminals <= 4.5.2.1`\n\n## Remediation\n\nST Engineering iDirect has fixed the vulnerabilities and recommend users update the software to version 4.5.3.0 or newer.\nRegistered users are able to download patches from the iDirect Support Portal:  https://support.idirect.net https://support.idirect.net/ \n\n  *  Restrict management interfaces to trusted networks (e.g., VPN, ACLs).\n  *  Avoid exposing administrative APIs to the public internet.\n  *  Enforce strong authentication practices.\n  *  Monitor for anomalous API activity and unexpected device reboots.","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}