CISA ICSA-26-183-01: ST Engineering iDirect Terminals Authentication Bypass & CSRF CVEs

Vulnerability Overview Vulnerability Name: ST Engineering iDirect iQ-Series Terminals Publication Date: July 2, 2026 Alert Code: ICSA-26-183-01 Related Topics: Industrial Control System Vulnerabilities, Industrial Control Systems Scope of Impact Affected Versions: - Evolution iQ-Series terminals <=4.5.2.1 (CVE-2026-38059, CVE-2026-38057) - 3315-Series terminals <=4.5.2.1 (CVE-2026-38059, CVE-2026-38057) - 9-Series terminals <=4.5.2.1 (CVE-2026-38059, CVE-2026-38057) CVSS Score: v3 8.1 Vendor: ST Engineering iDirect Device: ST Engineering iDirect iQ-Series Terminals Vulnerability Type: Missing Authentication for Critical Function, Cross-Site Request Forgery (CSRF) Remediation Recommended Practices: - Minimize network exposure to ensure that all control system devices and/or systems are not accessible via the Internet. - Place control system networks and remote devices behind firewalls and isolate them from business networks. - Use more secure remote access methods, such as Virtual Private Networks (VPNs), and ensure that VPNs are updated to the latest version. - Conduct appropriate impact analysis and risk assessments to deploy defensive measures. - Implement recommended cybersecurity strategies to proactively defend ICS assets. - Follow internal procedures to report suspicious malicious activity. - Do not click links in emails or open attachments to avoid email fraud. Vulnerability Details CVE-2026-38059: Missing Authentication for Critical Function CVE-2026-38057: Cross-Site Request Forgery (CSRF) Background Critical Infrastructure Sectors: Communications, Defense Industrial Base, Energy, Government Services and Facilities, Transportation Systems Deployed Countries/Regions: Global Company Headquarters Location: United States Acknowledgments Ahmed Alqahtani of Aramco reported these vulnerabilities to CISA Legal Notice and Terms of Use This product is subject to this notice and privacy and use policy. Revision History Initial Publication Date: 2026-07-02 Revision: 1 Summary: Initial release Tags Sectors: Communications Sector, Defense Industrial Base Sector, Energy Sector, Government Services and Facilities Sector, Transportation Systems Sector Topics: Industrial Control System Vulnerabilities, Industrial Control Systems Related Advisories Schneider Electric Easergy MiCOM Px40 Series OpenPLC v3 Schneider Electric PowerChute Serial Shutdown Hitachi Energy e-mesh EMS Feedback Please share your thoughts. We recently updated our anonymous product survey; feedback is welcome. Contact Information CISA Central: 1-844-Say-CISA Contact Email: contact@cisa.dhs.gov Official Website CISA.gov: Official website of the U.S. Department of Homeland Security Other Links About CISA Budget and Performance DHS.gov FOIA Requests No FEAR Act Office of Inspector General Privacy Policy Subscribe The White House USA.gov Website Feedback Social Media Facebook X LinkedIn YouTube RSS Back to Top Back to Top Navbar Topics Focus Areas Resources & Tools News & Events Careers About Footer CISA.gov: Official website of the U.S. Department of Homeland Security Advertising None Navbar Topics Focus Areas Resources & Tools News & Events Careers About Footer CISA.gov: Official website of the U.S. Department of Homeland Security Advertising None Navbar Topics Focus Areas Resources & Tools News & Events Careers About Footer CISA.gov: Official website of the U.S. Department of Homeland Security Advertising None Navbar Topics Focus Areas Resources & Tools News & Events Careers About Footer CISA.gov: Official website of the U.S. Department of Homeland Security Advertising None Navbar Topics Focus Areas Resources & Tools News & Events Careers About Footer CISA.gov: Official website of the U.S. Department of Homeland Security Advertising None Navbar Topics Focus Areas Resources & Tools News & Events Careers About Footer CISA.gov: Official website of the U.S. Department of Homeland Security Advertising None Navbar Topics Focus Areas Resources & Tools News & Events Careers About Footer CISA.gov: Official website of the U.S. Department of Homeland Security Advertising None Navbar Topics Focus Areas Resources & Tools News & Events Careers About Footer CISA.gov: Official website of the U.S. Department of Homeland Security Advertising None Navbar Topics Focus Areas Resources & Tools News & Events Careers About Footer CISA.gov: Official website of the U.S. Department of Homeland Security Advertising None Navbar Topics Focus Areas Resources & Tools News & Events Careers About Footer CISA.gov: Official website of the U.S. Department of Homeland Security Advertising None Navbar Topics Focus Areas Resources & Tools News & Events Careers About Footer CISA.gov: Official website of the U.S. Department of Homeland Security Advertising None Navbar Topics Focus Areas Resources & Tools News & Events Careers About Footer CISA.gov: Official website of the U.S. Department of Homeland Security Advertising None Navbar Topics Focus Areas Resources & Tools News & Events Careers

Goal Reached Thanks to every supporter — we hit 100%!

CISA ICSA-26-183-01: ST Engineering iDirect Terminals Authentication Bypass & CSRF CVEs

More from this source