CVE-2026-38057 PUBLISHED

The iDirect iQ200 does not validate CSRF tokens on state-changing API endpoints after authentication. The /api/reboot endpoint accepts POST requests authenticated solely by a session cookie that lacks the SameSite attribute. A remote attacker can host a malicious web page that, when visited by an authenticated administrator, automatically submits a cross-site POST request causing an immediate device reboot and satellite link loss. Repeated attacks can sustain a denial-of-service condition.

• Restrict management interfaces to trusted networks (e.g., VPN, ACLs).

• Avoid exposing administrative APIs to the public internet.

• Enforce strong authentication practices.

• Monitor for anomalous API activity and unexpected device reboots.

ST Engineering iDirect has fixed the vulnerabilities and recommend users update the software to version 4.5.2.2 or newer.

Registered users are able to download patches from the iDirect Support Portal https://support.idirect.net/s/login

• Ahmed Alqahtani of Aramco reported this vulnerability to CISA. finder

• https://www.cisa.gov/news-events/ics-advisories/icsa-26-183-01
• https://support.idirect.net/s/login
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-183-01.json

• CWE-352 Cross-Site request forgery CWE