CVE-2026-71264

Name of the Vulnerable Software and Affected Versions WLED (affected versions not specified)

Description The software contains two security flaws. First, the 'GET /json/cfg' endpoint calls the serveJson() function without verifying the settings-PIN, allowing any unauthenticated client on the network to view general configuration details, including network, hardware, and LED setup. Second, the settings-PIN unlock state is managed by a single global boolean variable correctPIN rather than per-session state. Consequently, if any client provides the correct 4-digit PIN via the 'POST /json' endpoint, the correctPIN variable is set to true for all users. This grants all subsequent unauthenticated clients full write access to the configuration, enabling actions such as OTA firmware updates, WiFi reconfiguration, and factory resets until the device is rebooted.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.