What’s Vulnerable › Vulnerabilities

CVE-2026-94214: ST Engineering iDirect iDX/Evo iDX Location Header redirect

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-21 · updated 2026-10-14
• Weakness: CWE-601

Description

A vulnerability was found in ST Engineering iDirect iDX and Evo iDX. This affects an unknown part of the component Location Header Handler. Performing a manipulation of the argument Host results in open redirect. It is possible to initiate the attack remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.

Affected products

• ST Engineering iDirect Evo iDX: all versions
• ST Engineering iDirect iDX: all versions

References

• https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/IDIRECT-WEBSERVER-HOST-REDIRECT-002-vulndb.md
• https://vuldb.com/cve/CVE-2026-94214
• https://vuldb.com/submit/894245
• https://vuldb.com/vuln/408070
• https://vuldb.com/vuln/408070/cti

Get alerted when CVE-2026-94214 or the next vulnerability affects your stack