CVE-2026-38056 ST Engineering iDirect iQ-Series Terminals Missing Authorization
A local attacker with technician access can escalate privileges to full administrative control on iDirect iQ-Series satellite terminals.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-38056?
CVE-2026-38056 is a critical missing authorization vulnerability in ST Engineering iDirect 3315-Series terminals, published on 11 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A local privilege escalation vulnerability exists in the iDirect iQ200 VSAT terminal running firmware 23.0.1.0. The iQ200 is a rackmount satellite modem deployed across oil and gas, maritime, defense, and remote infrastructure as the primary, and often sole communications link for offshore rigs, vessels, and remote sites. Important context: the device ships from the factory with a pre-configured low-privilege local user account. This account is intended for field technicians who need shell access for maintenance and diagnostics but should not have full administrative control over the device. This built-in account provides the initial access required to exploit this vulnerability. No additional credentials need to be obtained or brute-forced.
Weakness: CWE-862
Which versions are affected by CVE-2026-38056?
How do I fix CVE-2026-38056?
No fix has been published for CVE-2026-38056 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-38056 being exploited?
There is no known exploitation of CVE-2026-38056 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-mrcj-hfx4-rpr6.