CVE-2026-94214CWE-601

CVE-2026-94214

Medium · published September 21, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
35.7
In the wild
Unconfirmed
What it is

A vulnerability was found in ST Engineering iDirect iDX and Evo iDX. This affects an unknown part of the component Location Header Handler. Performing a manipulation of the argument Host results in open redirect. It is possible to initiate the attack remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00425 · 35.7th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2026-09-21T17:17Z
References (5)
https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/IDIRECT-WEBSERVER-HOST-REDIRECT-002-vulndb.md · [email protected]https://vuldb.com/cve/CVE-2026-94214 · [email protected]https://vuldb.com/submit/894245 · [email protected]https://vuldb.com/vuln/408070 · [email protected]https://vuldb.com/vuln/408070/cti · [email protected]
EPSS history
Timeline
  • 23 SEP 03:49Z
    EPSS moved — → 0%
    epss
  • 21 SEP 12:15Z
    ST Engineering iDirect Evolution/Velocity WebServer Evolution Management Service login.html redirect
    cvelistv5