---
id: CVE-2026-38057
title: ST Engineering iDirect iQ-Series Terminals Cross-Site request forgery
summary: >-
  The iDirect iQ200 does not validate CSRF tokens on state-changing API
  endpoints after authentication. The /api/reboot endpoint accepts POST requests
  authenticated solely by a session cookie that lacks the SameSite attribute. A
  remote att…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-352
vendor: ST Engineering iDirect
product: Evolution iQ‑Series terminals
affected:
  - evolution_iq_series_terminals <= 4.5.2.1
  - 3315-series_terminals <= 4.5.2.1
  - 9-series_terminals <= 4.5.2.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-07-10T16:22:04.408644Z'
published: '2026-07-10'
updated: '2026-09-11'
sourceUpdated: '2026-09-11T14:41:03.950Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-38057'
references:
  - url: 'https://support.idirect.net'
  - url: 'https://www.cisa.gov/news-events/ics-advisories/icsa-26-183-01'
  - url: >-
      https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-183-01.json
tags:
  - cve.org
epss: 0.00313
epssPercentile: 0.21589
ingestedAt: '2026-09-11T18:53:56.566Z'
---

## Overview

The iDirect iQ200 does not validate CSRF tokens on state-changing API endpoints after authentication. The /api/reboot endpoint accepts POST requests authenticated solely by a session cookie that lacks the SameSite attribute. A remote attacker can host a malicious web page that, when visited by an authenticated administrator, automatically submits a cross-site POST request causing an immediate device reboot and satellite link loss. Repeated attacks can sustain a denial-of-service condition.

## Affected

- `evolution_iq_series_terminals <= 4.5.2.1`
- `3315-series_terminals <= 4.5.2.1`
- `9-series_terminals <= 4.5.2.1`

## Remediation

ST Engineering iDirect has fixed the vulnerabilities and recommend users update the software to version 4.5.3.0 or newer.
Registered users are able to download patches from the iDirect Support Portal:  https://support.idirect.net https://support.idirect.net/ 

  *  Restrict management interfaces to trusted networks (e.g., VPN, ACLs).
  *  Avoid exposing administrative APIs to the public internet.
  *  Enforce strong authentication practices.
  *  Monitor for anomalous API activity and unexpected device reboots.