What is CVE-2026-38058?

CVE-2026-38058 is a high-severity vulnerability in St Engineering Idirect 9-Series Terminals, classified under Exposure of Sensitive System Information to an Unauthorized Control Sphere. CVSS score: 8.1/10. Published 2026-09-11.

How severe is CVE-2026-38058?

High severity. CVSS v3 base score is 8.1 out of 10.

Vulnerability in St Engineering Idirect 9-Series Terminals

CVE-2026-38058

The endpoint on the iDirect iQ200 VSAT terminal returns the complete device configuration as JSON, including the SECURITY section which contains MD5-crypt password hashes for the root SSH and web administration accounts. Any user with valid web credentials can extract these hashes and crack them offline using commodity hardware.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.

Affected products

Weakness classification (CWE)

CWE-497 — Exposure of Sensitive System Information to an Unauthorized Control Sphere

References

Frequently asked questions

What is CVE-2026-38058?: CVE-2026-38058 is a high-severity vulnerability in St Engineering Idirect 9-Series Terminals, classified under Exposure of Sensitive System Information to an Unauthorized Control Sphere. CVSS score: 8.1/10. Published 2026-09-11.
How severe is CVE-2026-38058?: High severity. CVSS v3 base score is 8.1 out of 10.