CVE-2026-94214

MediumCVSS 4.3

Published: 21/09/2026(UTC)Updated: 14/10/2026(UTC)Translated: 14/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.46%

39th percentile - higher than 39% of all known CVEs

Summary

A vulnerability was found in ST Engineering iDirect iDX and Evo iDX, affecting the Location Header Handler component. Manipulation of the Host argument results in an open redirect, exploitable remotely, and the exploit has been made public. This vulnerability only affects products no longer supported by the maintainer.

Risk Assessment

A remote attacker can redirect users to malicious sites, facilitating phishing and credential theft. The risk applies only to environments running unsupported product versions.

Recommendation

Plan migration from unsupported iDX/Evo iDX products to supported releases (e.g., X10, X11, Velocity 5.x+). Until migration, restrict network access to these devices' interfaces.

Other vulnerabilities in ST Engineering iDirect iDX and Evo iDX

CVE-2026-94216Medium
A vulnerability was found in ST Engineering iDirect iDX and Evo iDX, affecting the /authorize file of the HTTP Request Handler component. Manipulation of the Success argument leads to HTTP response splitting, exploitable remotely, and the exploit has been publicly disclosed. This vulnerability only affects products no longer supported by the maintainer; current supported releases (X10, X11, Velocity 5.x+) have no validated evidence of impact.

Original NVD description (English source)

A vulnerability was found in ST Engineering iDirect iDX and Evo iDX. This affects an unknown part of the component Location Header Handler. Performing a manipulation of the argument Host results in open redirect. It is possible to initiate the attack remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS