Unauthenticated REST API Exposes Satellite Terminal Credentials

The iDirect iQ200 exposes the /api/identity and /api/ REST API endpoints without authentication. An unauthenticated attacker with network access can retrieve sensitive device information including the serial number, Device ID (DID), Terminal Private Key identifier (TPK), MAC address, and exact firmware version. The DID and TPK are used for satellite network authentication in the iDirect platform, potentially enabling terminal impersonation and network reconnaissance.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-38059 describes a critical authentication bypass in iDirect iQ200 satellite terminals where REST API endpoints (/api/identity and /api/) lack proper access controls. An attacker with network access can retrieve sensitive device identifiers including serial numbers, Device IDs (DID), Terminal Private Keys (TPK), MAC addresses, and firmware versions without credentials. This is particularly dangerous because the DID and TPK are cryptographic identifiers used for satellite network authentication—exposing them enables terminal impersonation attacks and facilitates lateral movement within satellite communication infrastructure. Organizations operating iDirect platforms for critical communications, emergency response, or remote operations face immediate risk of network compromise and credential harvesting.

Casky's 283 mapped skills detect the attack patterns underlying this vulnerability across MITRE ATT&CK's Reconnaissance (TA0004) and Credential Access (TA0006) tactics. Practitioners using Claude AI with extended reasoning would identify suspicious patterns including: unauthenticated API requests to identity endpoints, enumeration of device metadata without authentication tokens, extraction of cryptographic identifiers (DID/TPK), and unauthorized firmware version disclosure. The platform flags these activities as anomalous because legitimate satellite terminal operations require mutual authentication. Security teams would observe indicators such as repeated /api/identity queries from external sources, successful retrieval of device certificates and keys without valid credentials, and reconnaissance activity preceding potential terminal impersonation attempts—enabling detection before lateral movement or network access establishment occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-38059.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-38059

Casky has 283 skills that investigate the attack patterns behind CVE-2026-38059. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn