HIGH

CVE-2026-71264

2026-08-05 CVSS v3.1

CVSS

8.2

Description

WLED's GET /json/cfg endpoint (registered in wled00/wled_server.cpp) calls serveJson with no settings-PIN check, unlike the /edit endpoint which explicitly checks correctPIN, disclosing the device's general configuration (network, hardware, LED setup) to any unauthenticated client on the network.

Weakness (CWE)

CWE-862 Missing Authorization

EPSS Score

0.19%

Probability of exploitation in next 30 days

9.4th percentile

References

https://github.com/Aircoookie/WLED https://github.com/Aircoookie/WLED/blob/main/wled00/wled_server.cpp

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE