Description

A vulnerability was determined in ST Engineering iDirect Evolution and Velocity WebServer Evolution up to 20260717. This vulnerability affects the function authorize of the file /usr/sbin/webserver of the component HTTP Header Handler. Executing a manipulation of the argument Success can lead to open redirect. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-21T13:17:12.360Z",
  "pubdate": "2026-09-21T13:17:12.360Z",
  "executiveSummary": "A critical open redirect vulnerability exists within the ST Engineering iDirect Evolution and Velocity WebServer (up to version 20260717).\nThe vulnerability resides in the HTTP Header Handler component, specifically within the authorize function of the /usr/sbin/webserver executable.\nBy manipulating the 'Success' argument, an unauthenticated remote attacker can force the application to redirect users to arbitrary, potentially malicious, domains.\nThis flaw facilitates phishing campaigns and social engineering attacks, as the trusted origin of the iDirect interface can be leveraged to lure users toward credential harvesting or malware distribution sites.\nGiven that the vulnerability has been publicly disclosed without a corresponding vendor patch, the risk to operational environments is elevated.\nExploitation does not require advanced access levels, allowing remote attackers to trigger the redirect simply by crafting a malicious URL containing a target destination parameter.",
  "technicalDetails": "The vulnerability is classified as an open redirect (CWE-601) resulting from improper validation of user-supplied input in the HTTP redirection logic.\nThe root cause lies in the authorize function located within the /usr/sbin/webserver binary. When the web server processes a request, it utilizes the 'Success' argument to determine the destination of a post-authorization redirect.\nThe implementation fails to enforce a strict allowlist or canonicalization check on the target URL provided via the 'Success' argument. Consequently, the application interprets the parameter value as a trusted URL and issues an HTTP 3xx redirect response, sending the user's browser to the specified external domain.\nThe attack flow proceeds as follows: An attacker constructs a malicious URL targeting the vulnerable iDirect WebServer instance. The URL is structured such that the 'Success' parameter is assigned an arbitrary external URL (e.g., https://malicious-site.com). Upon visiting the crafted URL, the target's browser initiates a request to the iDirect web server. The /usr/sbin/webserver component executes the vulnerable authorize function, which fails to validate the redirection target and generates a Location header pointing to the attacker-controlled resource.\nBecause the server redirects the user from a legitimate and often trusted infrastructure component, users are more likely to interact with the secondary site, bypassing inherent suspicion. This mechanism is particularly effective in phishing scenarios where attackers masquerade as internal system notifications or authentication prompts.\nThis vulnerability is reachable remotely over the network, as the WebServer component is exposed to incoming HTTP traffic. The exploitation requires no specific authentication or specialized user privileges, as the redirection occurs as part of the initial request handling flow within the authorize function.\nPost-exploitation, the attacker can leverage the trusted reputation of the iDirect device's hostname to host malicious content, deceive users, or perform man-in-the-middle operations by chaining the redirect with other client-side vulnerabilities. The lack of vendor response suggests that active monitoring of traffic to the WebServer component is necessary to detect exploitation attempts."
}