ikea vulnerabilities

Products

• dirigera 1
• dirigera firmware 1
• tradfri gateway e1526 firmware 1
• TRÅDFRI gateway system 1
• tradfri led1732g11 firmware 1
• TRÅDFRI smart lighting system 1

Latest ikea CVEs

Newest publication first

1. CVE-2026-3588 Server-Side Request Forgery (SSRF) in ikea dirigera

   Published 2026-03-09

   Medium·CVSS 5.5 EPSS 0.12%

   A server-side request forgery (SSRF) vulnerability in IKEA Dirigera v2.866.4 allows an attacker to exfiltrate private keys by sending a crafted request.

2. CVE-2022-39064 An attacker sending a single malformed IEEE 802.15.4 (Zigbee) frame makes the TRÅDFRI bulb blink, and if they replay (i.e. resend) the same frame multiple times, the bulb performs a factory reset. Thi...

   Published 2022-10-14

   High·CVSS 8.1 EPSS 0.40%

   An attacker sending a single malformed IEEE 802.15.4 (Zigbee) frame makes the TRÅDFRI bulb blink, and if they replay (i.e. resend) the same frame multiple times, the bulb performs a factory reset. This causes the bulb to lose configuration information about the Zigbee network and...

3. CVE-2022-39065 A single malformed IEEE 802.15.4 (Zigbee) frame makes the TRÅDFRI gateway unresponsive, such that connected lighting cannot be controlled with the IKEA Home Smart app and TRÅDFRI remote control. The m...

   Published 2022-10-14

   Medium·CVSS 6.5 EPSS 0.40%

   A single malformed IEEE 802.15.4 (Zigbee) frame makes the TRÅDFRI gateway unresponsive, such that connected lighting cannot be controlled with the IKEA Home Smart app and TRÅDFRI remote control. The malformed Zigbee frame is an unauthenticated broadcast message, which means all v...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.