The vulnerability resides in unknown code in the /authorize component of the HTTP Request Handler in ST Engineering iDirect iDX and Evo iDX. Manipulation of the Success argument allows an attacker to inject CRLF sequences into the server’s response, enabling HTTP response splitting that can add arbitrary headers or payloads. The exploit was publicly disclosed, can be launched remotely, and has been validated on unsupported legacy variants such as EOL X7 or Evolution 21.x; no validated evidence of impact exists for current supported releases (X10, X11, Velocity 5.x+).

Entities running ST Engineering iDirect Evo iDX or ST Engineering iDirect iDX are impacted. The vulnerability is located in the /authorize component of the HTTP Request Handler. No specific product versions are listed in the official data; it has been validated on at least one EOL variant (X7 or an un‑modelled Evolution 21.x) and no validated impact has been reported for newer supported releases (X10, X11, Velocity 5.x+).

The advisory rates the vulnerability with a CVSS score of 5.3, placing it in the medium severity range. An EPSS score of less than 1% indicates that the probability of exploitation is low, and the weakness is not cataloged in CISA's KEV database. Attackers can execute the exploit remotely by crafting requests that alter the Success parameter, yet no vendor patch or fix has yet been disclosed, meaning the risk persists until an update is applied or mitigated through other controls.