Description

A vulnerability was found in ST Engineering iDirect Evolution and Velocity WebServer Evolution up to 20260717. This affects an unknown part of the file /login.html of the component Management Service. Performing a manipulation of the argument Host results in open redirect. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-21T13:17:12.170Z",
  "pubdate": "2026-09-21T13:17:12.170Z",
  "executiveSummary": "A critical open redirect vulnerability exists within the Management Service component of ST Engineering iDirect Evolution and Velocity WebServer versions up to 20260717.\nThe vulnerability originates from improper validation of user-supplied input provided to the 'Host' argument within the '/login.html' file.\nThis flaw allows remote, unauthenticated attackers to redirect users to arbitrary, potentially malicious external domains by crafting specifically designed URIs.\nThe risk is elevated due to the public availability of exploitation details and the lack of vendor response to early disclosure.\nThe primary security implication involves facilitating sophisticated phishing campaigns, bypassing organizational URL filtering, and conducting credential harvesting attacks against authenticated administrative users.\nExploitation is trivial, requiring only remote network access to the web management interface and no prior authentication or system privileges.",
  "technicalDetails": "The vulnerability is classified as an Open Redirect, triggered by the insecure handling of the 'Host' parameter in the '/login.html' endpoint of the Management Service.\nThe root cause is the failure of the application to perform sufficient canonicalization or validation of the input supplied to the 'Host' argument before utilizing it in an HTTP redirection response.\nWhen a request is submitted to /login.html, the application processes the 'Host' parameter to construct a redirect destination. Because the input is not constrained to a whitelist of trusted domains or validated for origin, an attacker can supply an arbitrary URL as the parameter value.\nThe attack flow begins when an attacker sends a crafted URL to an authorized user of the system. This URL contains a malicious payload injected into the 'Host' parameter of the web server address.\nUpon clicking the link, the user is directed to the legitimate iDirect login page, which subsequently initiates an HTTP 302 or similar redirect response toward the attacker-controlled destination.\nThis bypasses user suspicion because the initial request originates from a trusted, legitimate domain associated with the iDirect infrastructure.\nThe vulnerability is remotely exploitable without authentication, meaning an attacker does not require access to internal system credentials to initiate the redirect.\nThe exposure is widespread as the Management Service is typically accessible over the network for administrative purposes.\nPost-exploitation impact includes the successful delivery of malicious content, facilitation of credential theft through deceptive landing pages that mimic legitimate authentication portals, and the potential to host malware or social engineering content behind the trust boundary of the iDirect web server.\nThe lack of sanitization logic within the server-side code responsible for header generation or location redirection headers confirms a lack of defensive controls against parameter manipulation in the Management Service."
}