ST Engineering iDirect Terminals: Local Privilege Escalation (CVE-2026-38056)

CVE-2026-38056 is a critical local privilege escalation vulnerability affecting ST Engineering iDirect iQ-Series, 3315-Series, and 9-Series terminals. The vulnerability is caused by a design flaw in the inter-process communication (IPC) model: the Redis bus is configured without authentication, and the 'sysmngr' service executes installation scripts provided through Redis keys without verifying their integrity, ownership, or location. An attacker with local access to the terminal can manipulate Redis keys to force the execution of arbitrary commands as the root user.

Attack Chain

1. Attacker gains initial local access (shell) to the satellite terminal.
2. Attacker interacts with the unauthenticated Redis IPC bus via the pre-installed redis-cli tool.
3. Attacker sets the INSTALL_DIR Redis key to a path controlled by the attacker (e.g., /tmp/pkg).
4. Attacker creates a malicious shell script (e.g., /tmp/escalate.sh) to perform unauthorized modifications such as changing user UIDs in /etc/passwd.
5. Attacker sets the INSTALL_SCRIPT Redis key to the path of the malicious script.
6. Attacker triggers the installation process by setting the INSTALL_START key to 1.
7. The sysmngr service executes the attacker-provided script with root privileges.
8. Attacker gains persistent root access on the terminal.

Impact

Successful exploitation allows any unprivileged user, including restricted field-technician accounts, to escalate privileges to root. This grants full control over the terminal, enabling firmware modification, traffic interception, credential harvesting, satellite link manipulation, and lateral movement to other network-connected infrastructure.

Recommendation

1. Upgrade all affected iQ-Series, 3315-Series, and 9-Series terminals to firmware version 4.5.3.0 or newer immediately.
2. For terminals that cannot be upgraded, implement the following mitigations:

• Apply a strong requirepass password in /etc/idirect/redis.conf and update all system processes to authenticate.
• Restrict Redis network access by binding it to 127.0.0.1.
• Implement host-based firewall rules (e.g., iptables) to block unauthorized access to the Redis port (6379) from external interfaces.
• Proactively audit current user accounts and /etc/passwd for unauthorized UID modifications.