LinkAce implements a firewall that blocks direct requests to private IP addresses, but this protection can be bypassed when an internal hostname is used. The vulnerability is an instance of Server‑Side Request Forgery, CWE‑918, that allows an authenticated user to force the application to resolve an internal hostname and reach internal‑only resources. This could expose sensitive data or enable lateral movement within the internal network.

The flaw exists in Kovah’s LinkAce releases older than version 2.5.3, where the SSRF protection fails to block requests originating from internal hostnames. Version 2.5.3 introduces the fix that fully blocks such SSRF attempts.

The CVSS score of 8.5 indicates high severity, but the EPSS score of less than 1 % suggests low exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Attack requires user authentication and the ability to specify internal hostnames, limiting impact to privileged accounts. Despite the low likelihood of exploitation, the potential damage warrants immediate remediation.