CVE-2026-94214 ST Engineering iDirect CVE debrief

Who should care

ST Engineering iDirect iDX and Evo iDX users, security teams assessing exposure and prioritizing verification, and operators of affected systems should review and verify the vulnerability details to ensure their systems are not exposed to potential exploitation.

Why it matters

The vulnerability allows for open redirect, which could be used to manipulate users. It affects unsupported ST Engineering iDirect iDX and Evo iDX products, requiring verification of exposure and potential exploitation.

• Assess exposure of ST Engineering iDirect iDX and Evo iDX deployments
• Verify if open redirect can be exploited in the environment
• Consider compensating controls for unsupported products

Technical summary

The vulnerability affects ST Engineering iDirect iDX and Evo iDX, specifically the Location Header Handler. An open redirect can be triggered by manipulating the Host argument. This vulnerability only affects products that are no longer supported by the maintainer. The vulnerability allows for open redirect, which could be used to manipulate users. It affects unsupported ST Engineering iDirect iDX and Evo iDX products, requiring verification of exposure and potential exploitation. ST Engineering iDirect iDX and Evo iDX users, security teams assessing exposure and prioritizing verification

Defensive priority

Assess exposure and prioritize verification for ST Engineering iDirect iDX and Evo iDX deployments.

Recommended defensive actions

• Assess exposure of ST Engineering iDirect iDX and Evo iDX deployments
• Verify if open redirect can be exploited in the environment
• Consider compensating controls for unsupported products
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The CVE record and source item provide details on the vulnerability, but its impact and remediation require verification from official sources. The vulnerability affects ST Engineering iDirect iDX and Evo iDX, specifically the Location Header Handler. An open redirect can be triggered by manipulating the Host argument. ST Engineering iDirect iDX and Evo iDX users should assess exposure and prioritize verification.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.