CSRF Vulnerability Enables Unauthorized Satellite Device Reboot

The iDirect iQ200 does not validate CSRF tokens on state-changing API endpoints after authentication. The /api/reboot endpoint accepts POST requests authenticated solely by a session cookie that lacks the SameSite attribute. A remote attacker can host a malicious web page that, when visited by an authenticated administrator, automatically submits a cross-site POST request causing an immediate device reboot and satellite link loss. Repeated attacks can sustain a denial-of-service condition.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-38057 is a cross-site request forgery (CSRF) vulnerability affecting iDirect iQ200 satellite communication devices. The flaw exists in the /api/reboot endpoint, which accepts state-changing POST requests authenticated only through a session cookie lacking the SameSite attribute. This means an attacker can craft a malicious webpage that, when visited by an authenticated administrator, silently triggers an unauthorized device reboot without requiring any explicit user action. For organizations operating satellite networks—including maritime, aviation, remote infrastructure, and critical communications sectors—this vulnerability is particularly dangerous because it directly impacts availability and can sustain denial-of-service conditions by repeatedly rebooting devices, causing prolonged satellite link loss and operational disruption.

Casky's 322 mapped skills use Claude AI with extended reasoning to detect the attack patterns underlying this vulnerability across TA0001 (Initial Access) and TA0043 (Reconnaissance) techniques. Practitioners using Casky would identify suspicious findings including: detection of malicious cross-site requests in web traffic logs, recognition of unauthenticated state-change attempts on API endpoints, identification of missing CSRF token validation patterns, and flagging of cookies without SameSite attributes during security assessments. The platform's skill set would highlight the dangerous combination of weak session management and lack of request origin validation, enabling security teams to discover similar CSRF weaknesses in their satellite and IoT device ecosystems before attackers exploit them.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-38057.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-38057

Casky has 322 skills that investigate the attack patterns behind CVE-2026-38057. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn