Medium severity · published Sep 21, 2026
CVE-2026-94214
ST Engineering iDirect iDX/Evo iDX Location Header redirect
4.3
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability was found in ST Engineering iDirect iDX and Evo iDX. This affects an unknown part of the component Location Header Handler. Performing a manipulation of the argument Host results in open redirect. It is possible to initiate the attack remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EI
Evo iDX · ST Engineering iDirect
All versions, or not specified · source: vendor
ID
iDX · ST Engineering iDirect
All versions, or not specified · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-94214
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-94214
vdb-entry
https://vuldb.com/vuln/408070
signature
https://vuldb.com/vuln/408070/cti
third-party-advisory
https://vuldb.com/cve/CVE-2026-94214
third-party-advisory
https://vuldb.com/submit/894245
exploit
https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/IDIRECT-WEBSERVER-HOST-REDIRECT-002-vulndb.md
More from Evo iDX
4.3
CVE-2026-94216
ST Engineering iDirect iDX/Evo iDX HTTP Request authorize response splitting