TI-2026-63377 Aliases CVE-2026-94216 GHSA-mg2v-v6xc-r2vv

ST Engineering iDirect iDX/Evo iDX HTTP Request authorize response splitting

MEDIUM 57CWE-113Published 2026-09-21 · Updated 2026-10-14

Key facts

Attack vector: Network
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: None · Low · None
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

A vulnerability was determined in ST Engineering iDirect iDX and Evo iDX. This vulnerability affects unknown code of the file /authorize of the component HTTP Request Handler. Executing a manipulation of the argument Success can lead to http response splitting. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The validated environment is an EOL X7 (or an un-modelled legacy Evolution 21.x), and current supported releases (X10, X11, Velocity 5.x+) have no validated evidence of impact. This vulnerability only affects products that are no longer supported by the maintainer.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00449 39th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ST Engineering iDirect	iDX	all versions	—	No fix listed	CNA
ST Engineering iDirect	Evo iDX	all versions	—	No fix listed	CNA

iDX VendorST Engineering iDirect Affected all versions Fixed in — No fix listed CNA
Evo iDX VendorST Engineering iDirect Affected all versions Fixed in — No fix listed CNA

CPE names CNA · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:st_engineering_idirect:idx::::::::	—	—	ST Engineering iDirect
cpe:2.3:a:st_engineering_idirect:evo_idx::::::::	—	—	ST Engineering iDirect

cpe:2.3:a:st_engineering_idirect:idx:*:*:*:*:*:*:*:* Versions — — ·ST Engineering iDirect
cpe:2.3:a:st_engineering_idirect:evo_idx:*:*:*:*:*:*:*:* Versions — — ·ST Engineering iDirect

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-94216
2026-10-03 Alias added: GHSA-mg2v-v6xc-r2vv
2026-10-14 Title updated · CNA
2026-10-14 Affected versions changed · CNA

References

Exploit 1

https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/IDIRECT-WEBSERVER-CRLF-OPENREDIRECT-001-vulndb.md

TI-2026-63375 ST Engineering iDirect iDX/Evo iDX Location Header redirect CVSS 4.0MEDIUM 5.3
TI-2026-28111 ST Engineering iDirect iQ-Series Terminals Missing authentication for critical function CVSS 4.0HIGH 8.7
TI-2026-28108 ST Engineering iDirect iQ-Series Terminals Missing Authorization CVSS 4.0CRITICAL 9.4
TI-2026-28110 ST Engineering iDirect iQ-Series Terminals Exposure of Sensitive System Information to an Unauthorized Control Sphere CVSS 4.0HIGH 8.6
TI-2026-28109 ST Engineering iDirect iQ-Series Terminals Cross-Site request forgery CVSS 4.0HIGH 7.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences