{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/9-series-terminals--4.5.3.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-38056"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["iQ-Series terminals (\u003c 4.5.3.0)","3315-Series terminals (\u003c 4.5.3.0)","9-Series terminals (\u003c 4.5.3.0)"],"_cs_severities":["critical"],"_cs_tags":["privilege-escalation","critical-infrastructure","embedded-systems"],"_cs_type":"advisory","_cs_vendors":["ST Engineering iDirect"],"content_html":"\u003cp\u003eCVE-2026-38056 is a critical local privilege escalation vulnerability affecting ST Engineering iDirect iQ-Series, 3315-Series, and 9-Series terminals. The vulnerability is caused by a design flaw in the inter-process communication (IPC) model: the Redis bus is configured without authentication, and the 'sysmngr' service executes installation scripts provided through Redis keys without verifying their integrity, ownership, or location. An attacker with local access to the terminal can manipulate Redis keys to force the execution of arbitrary commands as the root user.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains initial local access (shell) to the satellite terminal.\u003c/li\u003e\n\u003cli\u003eAttacker interacts with the unauthenticated Redis IPC bus via the pre-installed \u003ccode\u003eredis-cli\u003c/code\u003e tool.\u003c/li\u003e\n\u003cli\u003eAttacker sets the \u003ccode\u003eINSTALL_DIR\u003c/code\u003e Redis key to a path controlled by the attacker (e.g., \u003ccode\u003e/tmp/pkg\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eAttacker creates a malicious shell script (e.g., \u003ccode\u003e/tmp/escalate.sh\u003c/code\u003e) to perform unauthorized modifications such as changing user UIDs in \u003ccode\u003e/etc/passwd\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker sets the \u003ccode\u003eINSTALL_SCRIPT\u003c/code\u003e Redis key to the path of the malicious script.\u003c/li\u003e\n\u003cli\u003eAttacker triggers the installation process by setting the \u003ccode\u003eINSTALL_START\u003c/code\u003e key to 1.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003esysmngr\u003c/code\u003e service executes the attacker-provided script with root privileges.\u003c/li\u003e\n\u003cli\u003eAttacker gains persistent root access on the terminal.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows any unprivileged user, including restricted field-technician accounts, to escalate privileges to root. This grants full control over the terminal, enabling firmware modification, traffic interception, credential harvesting, satellite link manipulation, and lateral movement to other network-connected infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade all affected iQ-Series, 3315-Series, and 9-Series terminals to firmware version 4.5.3.0 or newer immediately.\u003c/li\u003e\n\u003cli\u003eFor terminals that cannot be upgraded, implement the following mitigations:\u003c/li\u003e\n\u003c/ol\u003e\n\u003cul\u003e\n\u003cli\u003eApply a strong \u003ccode\u003erequirepass\u003c/code\u003e password in \u003ccode\u003e/etc/idirect/redis.conf\u003c/code\u003e and update all system processes to authenticate.\u003c/li\u003e\n\u003cli\u003eRestrict Redis network access by binding it to \u003ccode\u003e127.0.0.1\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eImplement host-based firewall rules (e.g., \u003ccode\u003eiptables\u003c/code\u003e) to block unauthorized access to the Redis port (6379) from external interfaces.\u003c/li\u003e\n\u003cli\u003eProactively audit current user accounts and \u003ccode\u003e/etc/passwd\u003c/code\u003e for unauthorized UID modifications.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-28T05:47:02Z","date_published":"2026-10-28T05:47:02Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-38056/","summary":"A local privilege escalation vulnerability in ST Engineering iDirect satellite terminals allows unprivileged users to achieve root access via an insecure Redis IPC bus and unsanitized script execution.","title":"ST Engineering iDirect Terminals: Local Privilege Escalation (CVE-2026-38056)","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-38056/"}],"language":"en","title":"CraftedSignal Threat Feed - 9-Series Terminals (\u003c 4.5.3.0)","version":"https://jsonfeed.org/version/1.1"}