CVE-2026-38059 is a missing authentication vulnerability (CWE-306) in ST Engineering iDirect Evolution iQ-Series terminals. The terminals expose the /api/identity and /api/ REST API endpoints without requiring authentication, allowing unauthenticated attackers with network access to access sensitive device information including serial number, Device ID (DID), Terminal Private Key identifier (TPK), MAC address, and exact firmware version. The DID and TPK are critical for satellite network authentication within the iDirect platform, which could enable attackers to impersonate terminals or conduct network reconnaissance. The vulnerability is rated high severity with a CVSS 4.0 score of 8.7. No vendor advisory or patch information is currently available, and the vulnerability affects the product as a whole without specific version details.

An unauthenticated attacker with network access can retrieve sensitive device information that includes identifiers and keys used for satellite network authentication. This exposure could lead to terminal impersonation and unauthorized network reconnaissance, potentially compromising the security and integrity of satellite communications using the affected terminals.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the affected terminals' management interfaces to trusted users only and monitor for unauthorized access attempts. Avoid exposing the vulnerable API endpoints to untrusted networks.