{"id":"CVE-2026-94214","revision":"43b05b52288a4f14b0c340de4d98513e","records":[{"revision":"43b05b52288a4f14b0c340de4d98513e","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-94214","aliases":[],"title":"ST Engineering iDirect iDX/Evo iDX Location Header redirect","description":"A vulnerability was found in ST Engineering iDirect iDX and Evo iDX. This affects an unknown part of the component Location Header Handler. Performing a manipulation of the argument Host results in open redirect. It is possible to initiate the attack remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.","state":0,"publishedAt":"2026-09-21T12:15:08.559+00:00","modifiedAt":"2026-10-14T15:43:22.482+00:00","affected":[{"ecosystem":"Vendor product","name":"iDX","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"ST Engineering iDirect\",\n                    \"product\": \"iDX\",\n                    \"versions\": [\n                        {\n                            \"version\": \"n/a\",\n                            \"status\": \"affected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:2.3:a:st_engineering_idirect:idx:*:*:*:*:*:*:*:*\"\n                    ],\n                    \"modules\": [\n                        \"Location Header Handler\"\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Evo iDX","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"ST Engineering iDirect\",\n                    \"product\": \"Evo iDX\",\n                    \"versions\": [\n                        {\n                            \"version\": \"n/a\",\n                            \"status\": \"affected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:2.3:a:st_engineering_idirect:evo_idx:*:*:*:*:*:*:*:*\"\n                    ],\n                    \"modules\": [\n                        \"Location Header Handler\"\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","score":5.3,"severity":"MEDIUM"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R","score":4.3,"severity":"MEDIUM"},{"system":"CVSS 3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R","score":4.3,"severity":"MEDIUM"},{"system":"CVSS 2.0","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR","score":5,"severity":null}],"references":["https://vuldb.com/vuln/408070","https://vuldb.com/vuln/408070/cti","https://vuldb.com/cve/CVE-2026-94214","https://vuldb.com/submit/894245","https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/IDIRECT-WEBSERVER-HOST-REDIRECT-002-vulndb.md"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-94214","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-94214","identifiers":["CVE-2026-94214"]},"retained":false,"historicalAffected":[]}],"coverage":[]}