Technical impact
The vulnerability arises from the iDirect iQ200 VSAT terminal’s configuration retrieval endpoint, which returns a complete JSON representation of the device’s configuration. The JSON includes a SECURITY block that contains MD5‑crypt hashed passwords for the root SSH and web administration accounts. Because the endpoint is accessible to any user with valid web credentials, an attacker can obtain these hashes and later perform offline dictionary or brute‑force attacks to recover the plaintext passwords. This breach of confidentiality can lead to unauthorized access to administrative functions and potentially full device takeover if the root accounts are compromised.
Affected Systems
The affected devices are ST Engineering iDirect 3315‑Series terminals, 9‑Series terminals, and Evolution iQ‑Series terminals. The vendor advisories recommend updating each device to firmware version 4.5.3.0 or newer to resolve the issue. No specific pre‑update version that was affected is provided in the advisory; any device running a firmware version older than the recommended fix should be considered vulnerable until it is patched.
Risk and Exploitability
The vulnerability has a CVSS score of 8.6, indicating a high severity of information disclosure. EPSS is not provided, and the vulnerability is not listed in CISA’s KEV catalog. The exploitation requires a user to possess valid web credentials and an active network connection to the management interface, making the attack vector likely to be via the web UI or APIs that are publicly reachable. Once a valid credential is available, the attacker can retrieve the configuration JSON and offline crack the MD5‑crypt hashes, potentially allowing them to gain full administrative control of the terminal.
