Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.1
CVE-2026-94214: iDirect iDX/Evo iDX may redirect users to other sites
CVE-2026-94214 · published 28 days ago
Summary
The iDirect iDX and Evo iDX web interfaces can be tricked into sending visitors to a different website by manipulating the Host field. This open‑redirect can be launched from anywhere on the internet and the affected versions are no longer receiving security updates. Protect your network by disabling the vulnerable service, applying any available patches, or restricting access to the affected URLs.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| st engineering idirect | evolution | 20260717 |
| st engineering idirect | velocity webserver evolution | 20260717 |
| st engineering idirect | idx | All versions |
| st engineering idirect | evo idx | All versions |
Original advisory text
ST Engineering iDirect iDX/Evo iDX Location Header redirect
A vulnerability was found in ST Engineering iDirect iDX and Evo iDX. This affects an unknown part of the component Location Header Handler. Performing a manipulation of the argument Host results in open redirect. It is possible to initiate the attack remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
2.1
Low
Type
CWE-601Open Redirect
Timeline
Published21 Sep 2026
Updated19 Oct 2026
First seen21 Sep 2026
Track software like this
Free during beta