Local Privilege Escalation in iDirect iQ200 VSAT Terminal

Executive Summary

CVE-2026-38056 is a local privilege escalation flaw in the iDirect iQ200 VSAT terminal running firmware 23.0.1.0. The device ships with a pre-configured low-privilege local user account meant for maintenance. This account provides initial access to exploit the vulnerability, allowing an attacker to escalate privileges without needing additional credentials.

Useful 0 Not Useful 0

Detection Guidance

Detection of CVE-2026-38056 requires checking for unauthorized privilege escalation attempts on iDirect iQ200 VSAT terminals running firmware 23.0.1.0. Monitor for unusual shell access by the pre-configured low-privilege account. Inspect logs for commands executed with elevated permissions or changes to system configurations. Verify firmware versions and ensure no unauthorized modifications exist.

Useful 0 Not Useful 0

Impact Analysis

An attacker exploiting this vulnerability could gain full administrative control over the iQ200 terminal. This could disrupt communications for offshore rigs, vessels, or remote sites that rely on the device as their primary link. Attackers could modify configurations, intercept data, or disable critical services.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows local privilege escalation on the iDirect iQ200 VSAT terminal, which could enable unauthorized access to sensitive device information. This may impact compliance with regulations like GDPR or HIPAA by potentially exposing personal or protected health data transmitted or stored on the device. Unauthorized access could lead to data breaches, violating confidentiality requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Update the iDirect iQ200 VSAT terminal firmware to the latest version. Restrict management interfaces to trusted networks and avoid exposing administrative APIs to the public internet. Enforce strong authentication for all accounts, including the pre-configured low-privilege user.

Useful 0 Not Useful 0