Ahmed Alqahtani

The endpoint on the iDirect iQ200 VSAT terminal returns the complete device configuration as JSON, including the SECURITY section which contains MD5-crypt password hashes for the root SSH and web administration accounts. Any user with valid web credentials can extract these hashes and crack them offline using commodity hardware.

A local privilege escalation vulnerability exists in the iDirect iQ200 VSAT terminal running firmware 23.0.1.0. The iQ200 is a rackmount satellite modem deployed across oil and gas, maritime, defense, and remote infrastructure as the primary, and often sole communications link for offshore rigs, vessels, and remote sites. Important context: the device ships from the factory with a pre-configured low-privilege local user account. This account is intended for field technicians who need shell access for maintenance and diagnostics but should not have full administrative control over the device. This built-in account provides the initial access required to exploit this vulnerability. No additional credentials need to be obtained or brute-forced.

**Name of the Vulnerable Software and Affected Versions** iDirect iQ200 (affected versions not specified) **Description** The software fails to validate Cross-Site Request Forgery (CSRF) tokens on state-changing API endpoints after authentication. Specifically, the '/api/reboot' endpoint accepts POST requests authenticated only by a session cookie that lacks the SameSite attribute. This allows a remote attacker to host a malicious web page that, when visited by an authenticated administrator, triggers an automatic cross-site POST request. This action results in an immediate device reboot and loss of the satellite link, and repeated attacks can lead to a sustained denial-of-service condition. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** iDirect iQ200 (affected versions not specified) **Description** The device exposes the '/api/identity' and '/api/' REST API endpoints without authentication. An unauthenticated attacker with network access can retrieve sensitive device information, including the serial number, MAC address, exact firmware version, Device ID (`DID`), and Terminal Private Key identifier (`TPK`). The `DID` and `TPK` are used for satellite network authentication in the iDirect platform, which could allow for network reconnaissance and terminal impersonation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.