3315 Series Terminals
Approved changes feed: RSS · Atom
cpe:2.3:a:st_engineering_idirect:3315-series_terminals:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | St Engineering Idirect (bc3d45cf-c433-54be-b1b2-77c900e4054d) |
|---|---|
| Product | 3315 Series Terminals (d536c393-5e56-543c-861f-8cc24da77bd5) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-38056 |
vulnerable | 2026-09-16 04:33:06.109105 |
ST Engineering iDirect iQ-Series Terminals Missing Authorization
HIGH (8.8)
A local privilege escalation vulnerability exists in the iDirect iQ200 VSAT terminal running firmware 23.0.1.0. The iQ200 is a rackmount satellite modem deployed across oil and gas, maritime, defense, and remote infrastructure as the primary, and often sole communications link for offshore rigs, vessels, and remote sites. Important context: the device ships from the factory with a pre-configured low-privilege local user account. This account is intended for field technicians who need shell access for maintenance and diagnostics but should not have full administrative control over the device. This built-in account provides the initial access required to exploit this vulnerability. No additional credentials need to be obtained or brute-forced.
Published: 2026-09-11T14:50:00.859Z
Updated: 2026-09-11T15:02:42.163Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-38058 |
vulnerable | 2026-09-16 04:33:06.096399 |
ST Engineering iDirect iQ-Series Terminals Exposure of Sensitive System Information to an Unauthorized Control Sphere
HIGH (8.1)
The endpoint on the iDirect iQ200 VSAT terminal returns the complete device configuration as JSON, including the SECURITY section which contains MD5-crypt password hashes for the root SSH and web administration accounts. Any user with valid web credentials can extract these hashes and crack them offline using commodity hardware.
Published: 2026-09-11T14:44:37.571Z
Updated: 2026-09-11T15:02:06.162Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.