Velocity Webserver Evolution
Monthly
Open redirect in ST Engineering iDirect Evolution and Velocity WebServer Evolution (builds up to 20260717) lets remote, unauthenticated attackers craft a link whose manipulated 'Success' argument is processed by the authorize function in /usr/sbin/webserver, causing the victim's browser to be redirected to an attacker-chosen site. Impact is limited to integrity-low on the victim's browsing session - there is no server compromise, data disclosure, or denial of service - and exploitation depends on the victim actively following the crafted link (UI:P). Publicly available exploit code exists (per the VulDB-linked proof-of-concept write-up), but there is no confirmed active exploitation (not in CISA KEV); the vendor was contacted early and did not respond.
Open redirect in ST Engineering iDirect Evolution and Velocity WebServer Evolution (up to version 20260717) allows remote unauthenticated attackers to manipulate the Host argument on /login.html and redirect victims to arbitrary external websites. Exploitation requires user interaction-a victim must click a crafted link-and publicly available exploit code exists, though the vendor did not respond to disclosure. This low-severity issue affects the Management Service, which is typically isolated on satellite operations networks, and the integrity impact is limited to the redirect itself.
Open redirect in ST Engineering iDirect Evolution and Velocity WebServer Evolution (builds up to 20260717) lets remote, unauthenticated attackers craft a link whose manipulated 'Success' argument is processed by the authorize function in /usr/sbin/webserver, causing the victim's browser to be redirected to an attacker-chosen site. Impact is limited to integrity-low on the victim's browsing session - there is no server compromise, data disclosure, or denial of service - and exploitation depends on the victim actively following the crafted link (UI:P). Publicly available exploit code exists (per the VulDB-linked proof-of-concept write-up), but there is no confirmed active exploitation (not in CISA KEV); the vendor was contacted early and did not respond.
Open redirect in ST Engineering iDirect Evolution and Velocity WebServer Evolution (up to version 20260717) allows remote unauthenticated attackers to manipulate the Host argument on /login.html and redirect victims to arbitrary external websites. Exploitation requires user interaction-a victim must click a crafted link-and publicly available exploit code exists, though the vendor did not respond to disclosure. This low-severity issue affects the Management Service, which is typically isolated on satellite operations networks, and the integrity impact is limited to the redirect itself.