iDirect Evolution WebServer CVE-2026-94216

Exploitation requires the ST Engineering iDirect Evolution or Velocity WebServer Evolution HTTP interface (versions up to 20260717) to be network-reachable by the attacker, and it requires passive user interaction (UI:P) - a victim must click or follow the attacker-crafted link containing the manipulated 'Success' argument to the authorize function. No authentication is needed (PR:N). The primary limiter is the user-interaction dependency and the fact that impact is confined to redirecting the victim's browser (integrity-low); there is no direct server compromise, data disclosure, or denial of service. No non-default configuration is stated as required.

This is a genuinely low-severity issue whose raw score is modestly inflated by the unauthenticated network vector. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N) correctly caps impact at integrity-low with no confidentiality or availability consequence - an open redirect (CWE-601) only lets an attacker abuse the trusted iDirect WebServer hostname to bounce a victim to an attacker-chosen URL, typically for phishing or as a pivot in a social-engineering chain. Exploitation status is 'publicly available exploit code exists' (POC on GitHub, reported by VulDB) but there is NO KEV listing and NO EPSS score provided, so there is no evidence of active or widespread exploitation. The UI:P (passive user interaction) requirement is a real limiter: a victim must follow a crafted link, so this cannot be mass-automated the way a server-side RCE could. Note the referenced advisory filename ('...CRLF-OPENREDIRECT...') hints at an underlying CRLF/header-injection primitive, but the CVE description and CWE-601 scope the confirmed impact to open redirect only - the CRLF angle is not corroborated by the assigned CWE and should be verified before assuming header-injection severity. Net: real but low priority; patch/mitigate in normal cycle rather than emergency.

An attacker crafts a URL to the iDirect Evolution/Velocity WebServer that manipulates the 'Success' argument handled by the authorize function, embedding an attacker-controlled destination. The attacker sends this trusted-looking link to a satellite-network operator via phishing; when the operator clicks it, the WebServer redirects their browser to a malicious site (e.g., a credential-harvesting clone). A public POC for this exact endpoint is available on GitHub.