The CVE-2026-38057 vulnerability affects the iDirect iQ200 terminal in the Evolution iQ-Series by failing to validate CSRF tokens on state-changing API endpoints after authentication. Specifically, the /api/reboot endpoint accepts POST requests authenticated only by a session cookie that lacks the SameSite attribute, making it susceptible to CSRF attacks. An attacker can host a malicious webpage that, when visited by an authenticated administrator, automatically issues a cross-site POST request to reboot the device, causing satellite link disruption. This vulnerability can be exploited repeatedly to maintain a denial-of-service state. There is no vendor advisory or patch information available at this time.

Successful exploitation results in immediate reboot of the affected device, causing loss of satellite link connectivity. Repeated attacks can sustain denial-of-service conditions, disrupting network operations dependent on the terminal. The vulnerability requires the victim to be an authenticated administrator who visits a malicious webpage.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid visiting untrusted websites while authenticated to the device management interface. Network-level protections such as restricting administrative access to trusted networks may reduce exposure.