CVE-2026-38056
A local privilege escalation flaw in the iDirect iQ200 VSAT terminal allows a low‑privilege user to gain full administrative control. The vulnerability exists in firmware 23.0.1.0 and can be triggered without additional credentials. It threatens the primary communications link on offshore rigs, vessels, and remote sites.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
iDirect iQ200 VSAT terminal, firmware 23.0.1.0, used in oil and gas, maritime, defense, and remote infrastructure.
Real-world impact
An attacker who can log in with the factory‑provided low‑privilege account could take over the device, disrupt or intercept satellite communications, and potentially compromise the entire remote operation.
Why this severity
The CVSS score of 9.4 reflects the fact that the flaw is local, requires no additional access, and gives the attacker complete control over the device, affecting confidentiality, integrity, and availability.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources