The iDirect iQ200 performs no CSRF validation on its /api/reboot endpoint and accepts POST requests that are authenticated only by a session cookie lacking a SameSite attribute. A remote attacker can host a malicious web page that, when an authenticated administrator visits, will automatically submit the request. The firmware dutifully processes the request, rebooting the device and causing a satellite link loss. A single request can bring the device down, and repeated attacks can sustain a denial-of-service condition.

The flaw affects ST Engineering iDirect 3315-Series, 9-Series Terminals, and Evolution iQ-Series terminals running firmware older than 4.5.2.2. ST Engineering has supplied a patch that updates the affected firmware to version 4.5.2.2 or newer and provides the update through its iDirect Support Portal.

The CVSS score of 7 indicates high severity, while the EPSS score of < 1% indicates a very low likelihood that the vulnerability will be exploited in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to have the victim’s authenticated administrator session. Because the session cookie lacks a SameSite attribute and CSRF validation is missing, the victim’s browser will silently submit the request when the attacker’s malicious page loads, allowing a single POST to trigger a reboot and, with repetition, a prolonged outage. The likely attack vector is a social-engineering or phishing scenario delivered via a web page that the victim visits while logged into the device’s web interface.