THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-38059 (HIGH 7.5) — The iDirect iQ200 exposes the /api/identity and /api/ REST API endpoints without authentication. An unauthenticated attacker with network access can retrieve sensitive device information including the serial number, Device ID (DID), Terminal Private Key identifier (TPK), MAC addr

[NVD] CVE-2026-38059 (HIGH 7.5) — The iDirect iQ200 exposes the /api/identity and /api/ REST API endpoints without authentication. An unauthenticated attacker with network access can retrieve sensitive device information including the serial number, Device ID (DID), Terminal Private Key identifier (TPK), MAC addr

lownvdPublished 2026-07-10

CVE-2026-38059 CVSS: 7.5 HIGH Published: 2026-07-10T15:16:39.563

The iDirect iQ200 exposes the /api/identity and /api/ REST API endpoints without authentication. An unauthenticated attacker with network access can retrieve sensitive device information including the serial number, Device ID (DID), Terminal Private Key identifier (TPK), MAC address, and exact firmware version. The DID and TPK are u

MITRE ATT&CK techniques

ImpersonationT1684.001
ImpersonationAML.T0073

Indicators of compromise

CVE-2026-38059cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-38059