{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-38057", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2026-04-06T08:25:37.731Z", "datePublished": "2026-07-10T14:11:15.829Z", "dateUpdated": "2026-07-10T17:00:34.681Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2026-07-10T14:11:15.829Z" }, "title": "ST Engineering iDirect iQ-Series Terminals Cross-Site request forgery", "datePublic": "2026-07-02T17:00:00.000Z", "problemTypes": [ { "descriptions": [ { "lang": "en", "cweId": "CWE-352", "description": "CWE-352 Cross-Site request forgery", "type": "CWE" } ] } ], "affected": [ { "vendor": "ST Engineering iDirect", "product": "Evolution iQ‑Series terminals", "versions": [ { "status": "affected", "version": "0", "lessThanOrEqual": "4.5.2.1", "versionType": "custom" }, { "status": "unaffected", "version": "4.5.2.2" } ], "defaultStatus": "unaffected" }, { "vendor": "ST Engineering iDirect", "product": "3315-Series", "versions": [ { "status": "affected", "version": "0", "lessThanOrEqual": "4.5.2.1", "versionType": "custom" }, { "status": "unaffected", "version": "4.5.2.2" } ], "defaultStatus": "unaffected" }, { "vendor": "ST Engineering iDirect", "product": "9-Series Terminals", "versions": [ { "status": "affected", "version": "0", "lessThanOrEqual": "4.5.2.1", "versionType": "custom" }, { "status": "unaffected", "version": "4.5.2.2" } ], "defaultStatus": "unaffected" } ], "descriptions": [ { "lang": "en", "value": "The iDirect iQ200 does not validate CSRF tokens on state-changing API endpoints after authentication. The /api/reboot endpoint accepts POST requests authenticated solely by a session cookie that lacks the SameSite attribute. A remote attacker can host a malicious web page that, when visited by an authenticated administrator, automatically submits a cross-site POST request causing an immediate device reboot and satellite link loss. Repeated attacks can sustain a denial-of-service condition.", "supportingMedia": [ { "type": "text/html", "base64": false, "value": "The iDirect iQ200 does not validate CSRF tokens on state-changing API endpoints after authentication. The /api/reboot endpoint accepts POST requests authenticated solely by a session cookie that lacks the SameSite attribute. A remote attacker can host a malicious web page that, when visited by an authenticated administrator, automatically submits a cross-site POST request causing an immediate device reboot and satellite link loss. Repeated attacks can sustain a denial-of-service condition." } ] } ], "references": [ { "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-183-01" }, { "url": "https://support.idirect.net/s/login" }, { "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-183-01.json" } ], "metrics": [ { "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ], "cvssV4_0": { "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 7, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N" } }, { "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ], "cvssV3_1": { "version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 8.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H" } } ], "workarounds": [ { "lang": "en", "value": "* Restrict management interfaces to trusted networks (e.g., VPN, ACLs).\n\n * Avoid exposing administrative APIs to the public internet.\n\n * Enforce strong authentication practices.\n\n * Monitor for anomalous API activity and unexpected device reboots.", "supportingMedia": [ { "type": "text/html", "base64": false, "value": "" } ] } ], "solutions": [ { "lang": "en", "value": "ST Engineering iDirect has fixed the vulnerabilities and recommend users update the software to version 4.5.2.2 or newer.\n\n\n\nRegistered users are able to download patches from the iDirect Support Portal https://support.idirect.net/s/login", "supportingMedia": [ { "type": "text/html", "base64": false, "value": "ST Engineering iDirect has fixed the vulnerabilities and recommend users update the software to version 4.5.2.2 or newer.\n
\n
Registered users are able to download patches from the iDirect Support Portal https://support.idirect.net/s/login


" } ] } ], "credits": [ { "lang": "en", "value": "Ahmed Alqahtani of Aramco reported this vulnerability to CISA.", "type": "finder" } ], "source": { "advisory": "ICSA-26-183-01", "discovery": "EXTERNAL" }, "x_generator": { "engine": "Vulnogram 1.0.2" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2026-07-10T16:22:04.408644Z", "id": "CVE-2026-38057", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-10T17:00:34.681Z" } } ] } }