The flaw prevents CSRF validation on the /api/reboot endpoint, which accepts POST requests authenticated only by a session cookie that lacks the SameSite attribute. A malicious web page can submit a cross‑site POST request when a logged‑in administrator visits it, immediately rebooting the terminal and disconnecting its satellite link. Each successful request triggers a reboot, and repeated requests can keep the device offline, effectively causing a denial‑of‑service attack.

The vulnerability affects ST Engineering iDirect 3315‑Series, 9‑Series Terminals, and Evolution iQ‑Series terminals running firmware older than 4.5.2.2. ST Engineering recommends upgrading to firmware version 4.5.2.2 or newer, which is available through the iDirect Support Portal.

The CVSS score of 7 indicates high severity, while the EPSS score of <1% signals that exploitation is unlikely in the wild. The issue is not listed in the CISA KEV catalog. Exploitation requires that the attacker obtain an authenticated administrator’s session; because the session cookie lacks SameSite and CSRF validation is missing, a victim’s browser will silently submit the request when the attacker’s malicious page loads, enabling a single POST to trigger a reboot and, with repetition, a sustained outage. The likely attack vector involves social engineering or phishing that lures the administrator to a malicious web page while logged into the device’s web interface.