---
id: CVE-2026-94214
title: A vulnerability was found in ST Engineering iDirect iDX and Evo iDX
summary: >-
  A vulnerability was found in ST Engineering iDirect iDX and Evo iDX. This
  affects an unknown part of the component Location Header Handler. Performing a
  manipulation of the argument Host results in open redirect. It is possible to
  initia…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'
cwe:
  - CWE-601
vendor: ST Engineering iDirect
product: Evolution
affected:
  - Evolution 20260717
  - velocity_webserver_evolution 20260717
published: '2026-09-21'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T16:17:57.403'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-94214'
references:
  - url: >-
      https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/IDIRECT-WEBSERVER-HOST-REDIRECT-002-vulndb.md
    label: cna@vuldb.com
  - url: 'https://vuldb.com/cve/CVE-2026-94214'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/submit/894245'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/408070'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/408070/cti'
    label: cna@vuldb.com
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00425
epssPercentile: 0.3659
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-24T13:21:49.530410Z'
ingestedAt: '2026-09-21T12:36:35.290Z'
---

## Overview

A vulnerability was found in ST Engineering iDirect iDX and Evo iDX. This affects an unknown part of the component Location Header Handler. Performing a manipulation of the argument Host results in open redirect. It is possible to initiate the attack remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.