CVE-2026-94214: ST Engineering iDirect Evolution/Velocity WebServer Evolution Management Service login.html redirect
A vulnerability was found in ST Engineering iDirect Evolution and Velocity WebServer Evolution up to 20260717. This affects an unknown part of the file /login.html of the component Management Service. Performing a manipulation of the argument Host results in open redirect. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
An attacker can remotely manipulate the Host argument when interacting with the Management Service login.html endpoint. User interaction is required for the redirect to have an effect.
Which deployments may be affected?
The issue affects the Management Service login.html component in ST Engineering iDirect Evolution and Velocity WebServer Evolution versions up to 20260717. The available information does not state whether a default configuration exposes the affected service.
Is public exploitation information available?
Yes. A public exploit has been disclosed and could be used.
Is a vendor response or remediation available?
The vendor was contacted early in the disclosure process but did not respond. The provided information does not identify a vendor fix or workaround.