CVE-2026-3588 | Nozomi Networks Labs

Summary

A server-side request forgery (SSRF) vulnerability in IKEA Dirigera v2.866.4 allows an attacker to exfiltrate private keys by sending a crafted request.

Impact

A local authenticated attacker can exfiltrate private keys.

Issue Date

March 10, 2026

Affects

This issue affects firmware versions up to, and including, v2.866.4

CVE Name

CVE-2026-3588

CVSS Details

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L

CVSS Score

7.5

Solution

Update to the latest firmware.

Mitigations

Acknowledgements

Luca Borzacchiello at Nozomi Networks

Nozomi Threat Intelligence

Nozomi Networks Labs curates threat and vulnerability insights that are continuously fed into the Nozomi Networks platform to ensure our sensors can detect existing and emerging threats and vulnerabilities that threaten customers environments.

Learn more