Description (CNA)
The endpoint on the iDirect iQ200 VSAT terminal returns the complete device configuration as JSON, including the SECURITY section which contains MD5-crypt password hashes for the root SSH and web administration accounts. Any user with valid web credentials can extract these hashes and crack them offline using commodity hardware.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| ST Engineering iDirect / Evolution iQ‑Series terminals | affected 0 through 4.5.2.1; unaffected 4.5.3.0 |
| ST Engineering iDirect / 3315-Series terminals | affected 0 through 4.5.2.1; unaffected 4.5.3.0 |
| ST Engineering iDirect / 9-Series Terminals | affected 0 through 4.5.2.1; unaffected 4.5.3.0 |
CWE
CWE-497
References
- https://support.idirect.net
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-183-01
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-183-01.json
ADP enrichment
No English description supplied.
No references supplied.