The vulnerability in ST Engineering iDirect Evo iDX and iDX allows a remote attacker to manipulate the Host header to trigger an open redirect to arbitrary URLs, as detailed in the updated CVE description. This remains a CWE‑601 flaw that can facilitate phishing or social engineering attacks.

Affected systems are the ST Engineering iDirect Evo iDX and iDX platforms, all products that are no longer supported by the maintainer. The flaw resides in a component referred to as the Location Header Handler, and no specific version information is provided. Organizations running these products should verify whether their installed versions fall within this affected range.

The CVSS base score of 5.3 indicates a moderate impact and the EPSS score of < 1% shows a very low probability of exploitation, though the presence of a public exploit increases the risk. The vulnerability is not yet listed in the CISA KEV catalog, suggesting it is not known to be actively exploited, yet the public exploit indicates potential for misuse. Since the attack can be performed remotely by altering a legitimate request, the risk remains unless mitigated or patched.