iDirect Evolution CVE-2026-94214

Requires an attacker to send a crafted /login.html request to the Management Service with a manipulated Host argument, and a victim (typically a hub operator/administrator with access to the management portal) to click the resulting link - user interaction is mandatory (UI:P). No authentication is required to trigger the redirect (PR:N), and it is remotely reachable over the network (AV:N). Limiting factors: exploitation yields only an off-site redirect (low integrity, no code execution, no data read), the management interface is normally exposed only to satellite-network operations staff on restricted networks rather than the public internet, and success depends on social-engineering the victim into clicking the link.

This is a low-severity open redirect (CWE-601) in the Management Service login page (/login.html) of ST Engineering iDirect Evolution and Velocity WebServer Evolution, driven by attacker manipulation of the Host argument. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N, score 5.3) is internally consistent with an open redirect: network-reachable, no privileges, but requiring victim interaction (UI:P) and yielding only a low integrity impact with no confidentiality or availability loss. The E:P (proof-of-concept) exploit maturity aligns with the reported public POC on GitHub. No EPSS score, no CISA KEV listing, and no evidence of active exploitation are provided - so this is 'publicly available exploit code exists' rather than confirmed in-the-wild use. Realistically this is a high-nuisance/low-impact issue best used as a phishing enhancer (lending a trusted management-portal domain to a redirect), not a standalone compromise vector. Note the entry originates from VulDB (a high-volume disclosure source) and the vendor did not respond, so affected-version accuracy ('up to 20260717') is unverified. The single referenced 'exploit' link points to a markdown file in a repository titled for an unrelated WAVLINK command-injection issue, which lowers confidence in the artifact's provenance even though it is labeled for this iDirect Host-redirect finding.

An attacker crafts a link to the iDirect management portal's /login.html with a manipulated Host argument that causes the server to redirect the victim to an attacker-controlled site. A network/hub operator or administrator who clicks the trusted-looking management URL (UI:P) is silently sent off-site, enabling credential phishing or malware delivery. A public proof-of-concept for the redirect is referenced, but no active exploitation is reported.