CVE-2026-38057

Name of the Vulnerable Software and Affected Versions iDirect iQ200 (affected versions not specified)

Description The software fails to validate Cross-Site Request Forgery (CSRF) tokens on state-changing API endpoints after authentication. Specifically, the '/api/reboot' endpoint accepts POST requests authenticated only by a session cookie that lacks the SameSite attribute. This allows a remote attacker to host a malicious web page that, when visited by an authenticated administrator, triggers an automatic cross-site POST request. This action results in an immediate device reboot and loss of the satellite link, and repeated attacks can lead to a sustained denial-of-service condition.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.