A server-side request forgery flaw exists in IKEA Dirigera version 2.866.4, allowing an attacker to send crafted requests that the device will resolve and forward to arbitrary URLs. The vulnerability can be leveraged to reach internal resources and exfiltrate sensitive material such as private cryptographic keys. The weakness is classified as CWE‑918 and carries a CVSS score of 7.5, indicating a high impact if exploited.

The vulnerability affects the IKEA Dirigera Smart Home platform, specifically version 2.866.4. No other versions or related products are listed as affected in the available data.

The CVSS score suggests significant potential damage, though the EPSS score of less than 1% indicates a low estimated likelihood of exploitation at present. The vulnerability has not been cataloged in the CISA Known Exploited Vulnerabilities list. Attackers would need to place a forged request on the device, which is likely to be possible when the device is exposed to untrusted input sources such as public networks or mobile apps. No public exploit has been reported yet, but the path to exfiltrating private keys is clear once the flaw is triggered.