What’s Vulnerable › Vulnerabilities

CVE-2022-39065

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-10-14 · updated 2026-06-17
• Weakness: CWE-241

Description

A single malformed IEEE 802.15.4 (Zigbee) frame makes the TRÅDFRI gateway unresponsive, such that connected lighting cannot be controlled with the IKEA Home Smart app and TRÅDFRI remote control. The malformed Zigbee frame is an unauthenticated broadcast message, which means all vulnerable devices within radio range are affected. CVSS 3.1 Base Score: 6.5 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

• Ikea TRÅDFRI gateway system: before 1.19.26 — fixed in 1.19.26

How to fix

Upgrade to a fixed version: Ikea TRÅDFRI gateway system 1.19.26. Check the vendor advisory for mitigations.

References

• https://www.synopsys.com/blogs/software-security/cyrc-advisory-ikea-tradfri-smart-lighting-gateway/
• https://www.synopsys.com/blogs/software-security/cyrc-advisory-ikea-tradfri-smart-lighting-gateway/

Get alerted when CVE-2022-39065 or the next vulnerability affects your stack