What is the CVSS score of CVE-2026-3588?

CVE-2026-3588 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Dirigera Firmware are affected by CVE-2026-3588?

A critical vulnerability in IKEA Dirigera smart home hub (v2.866.4) allows attackers to steal private encryption keys through a server-side request forgery attack.

How to fix or mitigate CVE-2026-3588?

Within 24 hours: Inventory all IKEA Dirigera devices in your environment and isolate affected units from production networks if feasible. Within 7 days: Implement network segmentation to restrict Dirigera outbound traffic to known-good endpoints only, and apply WAF rules to block suspicious request patterns. Within 30 days: Monitor vendor advisories for patch availability and prepare a phased deployment plan; consider upgrading to patched firmware version immediately upon release.

Dirigera Firmware CVE-2026-3588

HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-03-09 prodsec@nozominetworks.com

SSRF Dirigera Firmware

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:56 vuln.today

CVE Published

Mar 09, 2026 - 16:16 nvd

HIGH 7.5

DescriptionCVE.org

A server-side request forgery (SSRF) vulnerability in IKEA Dirigera v2.866.4 allows an attacker to exfiltrate private keys by sending a crafted request.

AnalysisAI

IKEA Dirigera v2.866.4 contains a server-side request forgery vulnerability that enables authenticated attackers with high privileges to extract private cryptographic keys through specially crafted requests. The vulnerability impacts the confidentiality of sensitive authentication material while also introducing integrity and availability risks, though no patch is currently available.

Technical ContextAI

Classified as CWE-918 (Server-Side Request Forgery (SSRF)). Affects IKEA Dirigera v2.866.4. A server-side request forgery (SSRF) vulnerability in IKEA Dirigera v2.866.4 allows an attacker to exfiltrate private keys by sending a crafted request.