An SSRF flaw exists in the eAxios handler of the elecV2P URL module. The flaw arises when the argument ‘req’ passed to the /mock endpoint is manipulated, allowing an attacker to force the server to initiate HTTP requests to arbitrary internal or external hosts. The vulnerability can be leveraged from anywhere on the internet, and a publicly available exploit exists. Successful exploitation would give an attacker the ability to read or potentially modify data on internal services, compromising confidentiality, integrity, and potentially availability of those services.

The weakness affects the elecV2:elecV2P product, version 3.8.3 and earlier. Any deployment of these versions running the URL handler component is at risk.

With a CVSS score of 6.9 the risk is moderate, yet the absence of a public fix and the presence of an available exploit elevate the urgency. EPSS data is missing, and KEV does not list this issue, yet the remote nature of the attack means that containers or services exposed to the network could be compromised if the application is run without additional safeguards.