The flaw exists in the UrlCheckTool.checkUrl function of the debugToolV2 API endpoint in iFlytek astron-agent. An attacker can manipulate the endPoint parameter to cause the server to issue HTTP requests to arbitrary URLs, enabling server‑side request forgery (CWE‑918). This capability can allow the attacker to reach internal network resources that the host can connect to; while the description does not explicitly mention data exfiltration or internal resource discovery, it is inferred based on typical SSRF consequences that such actions are possible if the host has privileged connectivity.

Affected versions are all iFlytek astron-agent releases up to and including 1.0.6. The vulnerability is fixed in the reward‑1575 release, which contains the patched UrlCheckTool.checkUrl function.

The CVSS base score of 5.3 indicates moderate impact. The EPSS score is not provided, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploitation at the time of analysis. The attack vector is remote, requiring only the ability to send a crafted request to the debug endpoint; based on this, the likelihood of exploitation is uncertain but non‑negligible, especially when the debug API is exposed to untrusted networks. The potential impact includes use of the flaw to reach internal services, and inference indicates potential data exfiltration if the host can connect to protected resources.