CVE-2026-94214 in Evolution
Summary
by MITRE • 09/21/2026
A vulnerability was found in ST Engineering iDirect Evolution and Velocity WebServer Evolution up to 20260717. This affects an unknown part of the file /login.html of the component Management Service. Performing a manipulation of the argument Host results in open redirect. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/21/2026
The vulnerability identified within ST Engineering iDirect Evolution and Velocity WebServer Evolution, specifically affecting versions up to 20260717, represents a significant security flaw located in the Management Service component of the application infrastructure. The core issue resides within the handling of HTTP requests directed at the /login.html endpoint, which serves as the primary authentication gateway for administrative access and system configuration. This specific area of the codebase is responsible for processing incoming connection parameters to facilitate user login sessions, yet it fails to adequately validate or sanitize input data before proceeding with redirection logic. The flaw allows an attacker to manipulate the Host header argument within HTTP requests sent to this endpoint. By crafting a malicious request that includes a specially constructed Host value pointing to an external domain controlled by the adversary, the application inadvertently performs an open redirect operation rather than authenticating the user or displaying the intended login interface.
This type of vulnerability is formally classified under CWE-601, which defines URL Redirection to Untrusted Site (Open Redirect). The technical mechanism relies on the web server's failure to verify that the destination of a redirection matches expected internal domains or patterns. When an attacker supplies a malicious Host header, the application logic interprets this value as part of the redirect target without sufficient scrutiny. Consequently, after attempting to access the login page, users are silently redirected away from the legitimate ST Engineering environment to a phishing site or other malicious destination defined by the attacker. This behavior bypasses standard security controls that might otherwise rely on domain validation during authentication flows, creating a critical gap in the integrity of the user session establishment process.
The operational impact of this vulnerability is substantial due to its remote exploitability and public availability. Since the attack can be initiated remotely over the network without requiring prior authentication, it poses an immediate threat to any instance of iDirect Evolution or Velocity WebServer running vulnerable versions. The primary risk associated with open redirects in administrative interfaces like /login.html is phishing. Attackers can embed links containing these malicious redirect parameters within emails, social engineering campaigns, or other web-based vectors that appear to originate from the legitimate ST Engineering domain. When administrators click such links expecting to access their management console, they are instead directed to a counterfeit login page designed to harvest credentials. This undermines the confidentiality and integrity of administrative accounts, potentially leading to full system compromise if valid credentials are subsequently used by attackers on other services or systems within the network perimeter.
Furthermore, the public disclosure status of this vulnerability increases the likelihood of automated exploitation in the wild. Threat actors frequently scan for known vulnerabilities with available exploits, particularly those affecting widely deployed industrial and telecommunications infrastructure components like iDirect equipment. The lack of a vendor response to early contact regarding this disclosure exacerbates the risk profile, as there is no official patch or mitigation guidance provided by ST Engineering at this time. Organizations relying on these systems must therefore assume that active exploitation attempts are occurring against their environments. The absence of a fix means that defensive measures must be implemented externally through network-level controls and application firewall rules to mitigate the immediate threat while alternative remediation strategies are evaluated.
To address this vulnerability, organizations should implement strict input validation and output encoding practices at the web server or reverse proxy level if direct code modification is not immediately feasible. Configuring Web Application Firewalls (WAF) with specific rule sets designed to detect and block open redirect attempts based on suspicious Host header values can provide a layer of defense. Additionally, implementing Content Security Policy headers that restrict allowed origins for redirections can help prevent the browser from following malicious redirects even if they are generated by the application. Administrators should also enforce multi-factor authentication for all management interfaces to reduce the impact of potential credential theft resulting from successful phishing attacks facilitated by this redirect flaw. Regular monitoring of access logs for unusual redirection patterns involving external domains is recommended to detect ongoing exploitation attempts.
From a strategic security perspective, this incident highlights the importance of maintaining up-to-date software inventories and engaging proactively with vendors regarding disclosed vulnerabilities. The classification under MITRE ATT&CK technique T1566.002, specifically Spearphishing Link, underscores how such technical flaws are leveraged in broader attack campaigns targeting critical infrastructure operators. Security teams should treat this vulnerability as a high-severity issue requiring immediate attention due to its ease of exploitation and direct impact on authentication integrity. Until vendor-supplied patches become available or effective compensating controls are fully deployed, the risk exposure remains elevated for all deployments running affected versions of iDirect Evolution and Velocity WebServer Evolution.