Unauthenticated Information Disclosure in iDirect iQ200

Compliance Impact

The vulnerability allows unauthenticated attackers to access sensitive device information such as serial numbers, Device IDs, Terminal Private Key identifiers, MAC addresses, and firmware versions. This exposure of sensitive information could potentially lead to unauthorized access and terminal impersonation.

Such unauthorized access and exposure of sensitive data may impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of sensitive information and prevention of unauthorized access.

However, the provided information does not explicitly state the direct impact on compliance with these standards or any regulatory consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include updating the iDirect iQ200 device software to version 4.5.2.2 or newer, where the vulnerability has been fixed.

Additionally, restrict access to management interfaces and administrative APIs to trusted networks only, avoiding exposure to the public internet.

Enforce strong authentication mechanisms on all management and API endpoints to prevent unauthenticated access.

Finally, monitor network and device activity for any anomalous behavior that could indicate exploitation attempts.

Useful 0 Not Useful 0

Executive Summary

The vulnerability in the ST Engineering iDirect iQ200 platform allows an unauthenticated attacker with network access to access the /api/identity and /api/ REST API endpoints without any authentication.

This access enables the attacker to retrieve sensitive device information such as the serial number, Device ID (DID), Terminal Private Key identifier (TPK), MAC address, and exact firmware version.

The Device ID and Terminal Private Key identifier are critical for satellite network authentication, which means an attacker could potentially impersonate a terminal or perform network reconnaissance.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have significant impacts including unauthorized access to sensitive device information.

An attacker could use the retrieved Device ID and Terminal Private Key identifier to impersonate a legitimate terminal on the satellite network.

This could lead to unauthorized network access, potential disruption of services, and exposure of network infrastructure through reconnaissance activities.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to access the /api/identity and /api/ REST API endpoints on the iDirect iQ200 device without authentication. If these endpoints respond and return sensitive device information such as serial number, Device ID (DID), Terminal Private Key identifier (TPK), MAC address, or firmware version, the device is vulnerable.

A simple detection method is to use network tools like curl or wget to send HTTP GET requests to these endpoints from a system with network access to the device.

• curl http://<device-ip>/api/identity
• curl http://<device-ip>/api/

If these commands return sensitive information without requiring authentication, the vulnerability is present.

Useful 0 Not Useful 0