Description

The endpoint on the iDirect iQ200 VSAT terminal returns the complete device configuration as JSON, including the SECURITY section which contains MD5-crypt password hashes for the root SSH and web administration accounts. Any user with valid web credentials can extract these hashes and crack them offline using commodity hardware.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-11T15:17:01.407Z",
  "pubdate": "2026-09-11T15:17:01.407Z",
  "executiveSummary": "The iDirect iQ200 VSAT terminal suffers from an insecure information disclosure vulnerability that allows authenticated users to retrieve sensitive system configuration data. The device exposes a diagnostic or management endpoint that returns a full JSON representation of the system state, including the SECURITY section containing cryptographic password hashes for administrative accounts (root/SSH and web interface).\nThis vulnerability constitutes an Improper Access Control issue, as the device fails to restrict access to sensitive security material based on user privilege levels. By leveraging legitimate but low-privileged web credentials, an attacker can extract these hashes and perform offline brute-force or dictionary-based password cracking using commodity hardware. This leads to a total compromise of the device's management interface and operating system, enabling persistent unauthorized access, traffic interception, or modification of satellite communication parameters. The risk to the infrastructure is critical, as successful exploitation facilitates remote persistent access to remote terminals, potentially compromising the integrity of the satellite network segment.",
  "technicalDetails": "The vulnerability originates from a flawed design in the iDirect iQ200 management API, which inadvertently exposes raw configuration data via a RESTful or HTTP endpoint. The application fails to perform adequate data sanitization or field-level access control on the configuration payload. While the endpoint is intended to facilitate device monitoring or diagnostics, it includes highly sensitive credential material that should never be accessible via the standard management interface, even to authenticated web administrators.\nThe exploitation process follows a predictable pattern: 1) The attacker obtains valid credentials for the web administration portal through phishing, credential stuffing, or existing unauthorized access. 2) The attacker navigates to the specific diagnostic endpoint—typically identified via reconnaissance of the web application's API schema—and issues an authenticated GET request. 3) The server responds with a JSON object containing the complete device configuration tree. 4) The attacker parses the SECURITY object within the JSON payload to isolate the MD5-crypt password hashes associated with the root SSH user and web administration accounts.\nBecause the hashes are generated using the MD5-crypt algorithm, they are highly susceptible to high-speed offline cracking. Given the computational power available on modern GPUs, an attacker can iterate through large password wordlists or utilize mask-based attacks to recover plain-text credentials in a short timeframe. Once the hashes are cracked, the attacker can leverage the SSH service—which is often enabled on iDirect terminals for maintenance—to gain full shell access. This post-exploitation access allows the attacker to bypass application-layer restrictions, manipulate the satellite link configuration, install backdoors, or pivot deeper into the service provider’s internal network architecture. The vulnerability is effectively a failure to adhere to the principle of least privilege, as administrative security metadata is returned in cleartext-equivalent form to any authenticated user, regardless of their actual administrative requirements or intent."
}