https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-07T04:58:38.594193+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-38058 CVE-2026-38058 — ST Engineering iDirect iQ-Series Terminals Exposure of Sensitive System Information to an Unauthorized Control Sphere 2026-10-07T04:58:38.605669+00:00

Affected: ST Engineering iDirect Evolution iQ‑Series terminals, ST Engineering iDirect 3315-Series terminals, ST Engineering iDirect 9-Series Terminals

The endpoint on the iDirect iQ200 VSAT terminal returns the complete device configuration as JSON, including the SECURITY section which contains MD5-crypt password hashes for the root SSH and web administration accounts. Any user with valid web credentials can extract these hashes and crack them offline using commodity hardware.