CVE-2026-94214

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-94214", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-09-21T05:52:16.238Z", "datePublished": "2026-09-21T12:15:08.559Z", "dateUpdated": "2026-10-14T15:43:22.482Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-10-14T15:43:22.482Z"}, "title": "ST Engineering iDirect iDX/Evo iDX Location Header redirect", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-601", "lang": "en", "description": "Open Redirect"}]}], "affected": [{"vendor": "ST Engineering iDirect", "product": "iDX", "versions": [{"version": "n/a", "status": "affected"}], "cpes": ["cpe:2.3:a:st_engineering_idirect:idx:*:*:*:*:*:*:*:*"], "modules": ["Location Header Handler"]}, {"vendor": "ST Engineering iDirect", "product": "Evo iDX", "versions": [{"version": "n/a", "status": "affected"}], "cpes": ["cpe:2.3:a:st_engineering_idirect:evo_idx:*:*:*:*:*:*:*:*"], "modules": ["Location Header Handler"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in ST Engineering iDirect iDX and Evo iDX. This affects an unknown part of the component Location Header Handler. Performing a manipulation of the argument Host results in open redirect. It is possible to initiate the attack remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-09-21T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-09-21T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-10-14T17:47:31.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "ST4R0003 (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/vuln/408070", "name": "VDB-408070 | ST Engineering iDirect iDX/Evo iDX Location Header redirect", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/408070/cti", "name": "VDB-408070 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-94214", "name": "CVE-2026-94214 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/894245", "name": "Submit #894245 | ST Engineering iDirect Evolution/Velocity WebServer same 7 Host Header Injection / Open Redirect", "tags": ["third-party-advisory"]}, {"url": "https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/IDIRECT-WEBSERVER-HOST-REDIRECT-002-vulndb.md", "tags": ["exploit"]}], "tags": ["unsupported-when-assigned"], "x_generator": ["VulDB PVTS v202610"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-24T13:21:49.530410Z", "id": "CVE-2026-94214", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-24T13:21:59.523Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-94214", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-24T13:21:49.530410Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-24T13:21:55.475Z"}}], "cna": {"tags": ["unsupported-when-assigned"], "title": "ST Engineering iDirect iDX/Evo iDX Location Header redirect", "credits": [{"lang": "en", "type": "reporter", "value": "ST4R0003 (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:st_engineering_idirect:idx:*:*:*:*:*:*:*:*"], "vendor": "ST Engineering iDirect", "modules": ["Location Header Handler"], "product": "iDX", "versions": [{"status": "affected", "version": "n/a"}]}, {"cpes": ["cpe:2.3:a:st_engineering_idirect:evo_idx:*:*:*:*:*:*:*:*"], "vendor": "ST Engineering iDirect", "modules": ["Location Header Handler"], "product": "Evo iDX", "versions": [{"status": "affected", "version": "n/a"}]}], "timeline": [{"lang": "en", "time": "2026-09-21T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-09-21T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-10-14T17:47:31.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/408070", "name": "VDB-408070 | ST Engineering iDirect iDX/Evo iDX Location Header redirect", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/408070/cti", "name": "VDB-408070 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-94214", "name": "CVE-2026-94214 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/894245", "name": "Submit #894245 | ST Engineering iDirect Evolution/Velocity WebServer same 7 Host Header Injection / Open Redirect", "tags": ["third-party-advisory"]}, {"url": "https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/IDIRECT-WEBSERVER-HOST-REDIRECT-002-vulndb.md", "tags": ["exploit"]}], "x_generator": ["VulDB PVTS v202610"], "descriptions": [{"lang": "en", "value": "A vulnerability was found in ST Engineering iDirect iDX and Evo iDX. This affects an unknown part of the component Location Header Handler. Performing a manipulation of the argument Host results in open redirect. It is possible to initiate the attack remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-601", "description": "Open Redirect"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-10-14T15:43:22.482Z"}}}, "cveMetadata": {"cveId": "CVE-2026-94214", "state": "PUBLISHED", "dateUpdated": "2026-10-14T15:43:22.482Z", "dateReserved": "2026-09-21T05:52:16.238Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-09-21T12:15:08.559Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:st_engineering_idirect:idx:*:*:*:*:*:*:*:*"], "modules": ["Location Header Handler"], "product": "iDX", "vendor": "ST Engineering iDirect", "versions": [{"status": "affected", "version": "n/a"}]}, {"cpes": ["cpe:2.3:a:st_engineering_idirect:evo_idx:*:*:*:*:*:*:*:*"], "modules": ["Location Header Handler"], "product": "Evo iDX", "vendor": "ST Engineering iDirect", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cna@vuldb.com"}], "cveTags": [{"sourceIdentifier": "cna@vuldb.com", "tags": ["unsupported-when-assigned"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in ST Engineering iDirect iDX and Evo iDX. This affects an unknown part of the component Location Header Handler. Performing a manipulation of the argument Host results in open redirect. It is possible to initiate the attack remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer."}], "id": "CVE-2026-94214", "lastModified": "2026-10-14T16:17:57.403", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-94214", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-24T13:21:49.530410Z", "version": "2.0.3"}}]}, "published": "2026-09-21T13:17:12.170", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/IDIRECT-WEBSERVER-HOST-REDIRECT-002-vulndb.md"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-94214"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/894245"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/408070"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/408070/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-601"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "20260717"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Evolution", "source": "cna", "vendor": "ST Engineering iDirect"}, "product": "evolution", "vendor": "st_engineering_idirect"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "20260717"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Velocity WebServer Evolution", "source": "cna", "vendor": "ST Engineering iDirect"}, "product": "velocity_webserver_evolution", "vendor": "st_engineering_idirect"}], "created": "2026-09-21T13:30:16.802658+00:00", "updated": "2026-10-17T09:15:06.527613+00:00", "vendors": ["st_engineering_idirect", "st_engineering_idirect$PRODUCT$evolution", "st_engineering_idirect$PRODUCT$velocity_webserver_evolution"]}