CVE-2026-94216: iDirect WebServer Open Redirect Vulnerability

CVE-2026-94216 Overview

CVE-2026-94216 is an open redirect vulnerability in ST Engineering iDirect Evolution and Velocity WebServer Evolution up to build 20260717. The flaw resides in the authorize function of /usr/sbin/webserver within the HTTP Header Handler component. Attackers can manipulate the Success argument to redirect users to attacker-controlled destinations. The issue is classified under CWE-601 (URL Redirection to Untrusted Site). The exploit has been publicly disclosed, and the vendor did not respond to disclosure attempts.

Critical Impact
Attackers can craft URLs that appear to originate from a trusted iDirect satellite management interface, redirecting authenticated operators to phishing or malware-hosting sites.

Affected Products

ST Engineering iDirect Evolution WebServer up to 20260717
ST Engineering iDirect Velocity WebServer Evolution up to 20260717
HTTP Header Handler component in /usr/sbin/webserver

Discovery Timeline

2026-09-21 - CVE CVE-2026-94216 published to NVD
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-94216

Vulnerability Analysis

The vulnerability affects the authorize function inside the /usr/sbin/webserver binary shipped with iDirect Evolution and Velocity satellite management platforms. The function processes HTTP headers and consumes a Success parameter that determines where the client is redirected after authorization. Because the parameter value is written into a Location response header without validation against an allow-list of trusted destinations, an attacker controlling the value can point users to arbitrary external URLs. The attack requires user interaction, typically clicking a crafted link, but no authentication or privileges on the target system.

Root Cause

The root cause is missing validation of the Success argument before it is placed into an HTTP redirect response. The web server trusts client-supplied redirect targets and does not enforce host, scheme, or path restrictions. This is a textbook CWE-601 URL redirection flaw compounded by the header being reflected into the response, which can also enable CRLF-style manipulation as referenced in the public disclosure report.

Attack Vector

An attacker crafts a URL to the iDirect WebServer that specifies an attacker-controlled destination in the Success argument. The victim, typically a satellite network operator, receives the URL through email, chat, or a compromised web page. When clicked, the WebServer issues an HTTP redirect to the attacker's site. Because the initial hostname belongs to a trusted management console, the victim is more likely to enter credentials or download payloads at the destination. Full technical details are documented in the VulDB entry for CVE-2026-94216.

No verified proof-of-concept code is available in the enriched data. The public advisory describes the parameter manipulation pattern in prose without publishing a ready-to-use exploit script.

Detection Methods for CVE-2026-94216

Indicators of Compromise

HTTP requests to the iDirect WebServer containing a Success parameter with an external hostname, IP address, or protocol-relative URL.
Location response headers from /usr/sbin/webserver pointing to domains outside the organization's satellite management infrastructure.
Referrer logs on external phishing domains showing traffic originating from iDirect management URLs.

Detection Strategies

Inspect web server access logs for Success= values that resolve to hosts not on an approved allow-list.
Deploy web application firewall rules that flag redirect parameters containing http://, https://, //, or encoded variants.
Correlate outbound clicks from operator workstations with recent HTTP 3xx responses from the iDirect WebServer.

Monitoring Recommendations

Forward WebServer access and error logs to a centralized SIEM for parameter-level analysis.
Alert on anomalous spikes in redirect responses from the management interface.
Monitor DNS resolution for lookalike domains impersonating the iDirect management console.

How to Mitigate CVE-2026-94216

Immediate Actions Required

Restrict network access to the iDirect WebServer management interface to trusted operator subnets and VPN endpoints.
Educate satellite operations staff to inspect URLs before clicking links purporting to originate from the management console.
Deploy a reverse proxy or WAF in front of the WebServer to strip or validate the Success parameter.

Patch Information

The vendor was contacted about this disclosure and did not respond. No official patch is referenced in the enriched data. Organizations should track ST Engineering iDirect security bulletins and apply firmware updates as soon as they become available. Refer to the VulDB vulnerability record for ongoing status.

Workarounds

Configure the upstream proxy to reject requests where the Success argument contains an absolute URL, scheme, or leading //.
Rewrite redirect responses at the proxy layer to force redirects to a fixed internal landing page.
Isolate the management network from general corporate email and web browsing to reduce phishing exposure.

bash

# Example NGINX reverse proxy rule to block external redirect targets
location / {
    if ($arg_Success ~* "^(https?:)?//") {
        return 400;
    }
    proxy_pass http://idirect_webserver_backend;
}