CyberRota Analysis
AI-GeneratedThe WLED device is vulnerable due to improper access controls on the GET /json/cfg endpoint, which exposes sensitive configuration details to any unauthenticated client on the network. Additionally, once a correct settings-PIN is submitted by any client, it grants all subsequent clients unrestricted write access to critical device settings, including OTA firmware updates and network configurations, until the device is rebooted. Organizations using WLED devices should prioritize addressing this vulnerability to prevent unauthorized access and potential exploitation of their networked devices.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
WLED's GET /json/cfg endpoint (registered in wled00/wled_server.cpp) calls serveJson with no settings-PIN check, unlike the /edit endpoint which explicitly checks correctPIN, disclosing the device's general configuration (network, hardware, LED setup) to any unauthenticated client on the network.