CVE-2026-38058
HIGH
NVD
CVSS Score
8.1
Severity
HIGH
Published
Sep 11, 2026
Vendor
unknown
Description
The endpoint on the iDirect iQ200 VSAT terminal returns the complete device configuration as JSON, including the SECURITY section which contains MD5-crypt password hashes for the root SSH and web administration accounts. Any user with valid web credentials can extract these hashes and crack them offline using commodity hardware.