This vulnerability affects elecV2 elecV2P versions 3.8.0 through 3.8.3. It arises from improper handling of input in the eAxios function of the /mock URL Handler, enabling attackers to perform server-side request forgery by manipulating the req parameter. This can lead to the server making unauthorized requests to internal or external resources. The vulnerability is remotely exploitable without authentication and has a medium severity rating based on a CVSS 4.0 score of 6.9. The project was notified early but has not issued a fix or official response. No cloud service is involved, and no official patch or mitigation guidance is currently available.

Successful exploitation allows remote attackers to induce the vulnerable server to send crafted requests to arbitrary destinations, potentially exposing internal services or sensitive data accessible from the server. The impact is rated medium severity, reflecting the potential for information disclosure or interaction with internal network resources. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider applying network-level restrictions to limit the server's ability to make arbitrary outbound requests as a temporary mitigation. Monitor for updates from the vendor and apply official patches once available.