{"id":"CVE-2026-71264","aliases":["EUVD-2026-53349","GHSA-822p-39fj-m835"],"status":"published","title":"WLED Unauthenticated Configuration Disclosure via /json/cfg and Global Settings-PIN Lock State","description":"WLED's GET /json/cfg endpoint (registered in wled00/wled_server.cpp) calls serveJson with no settings-PIN check, unlike the /edit endpoint which explicitly checks correctPIN, disclosing the device's general configuration (network, hardware, LED setup) to any unauthenticated client on the network.","severity":{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00334,"percentile":0.26957,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2026-08-05T12:26:12Z","modified":"2026-10-24T15:10:00Z","products":[{"vendor":"aircoookie","product":"wled"}],"references":[{"url":"https://github.com/Aircoookie/WLED","tags":["third-party-advisory"]},{"url":"https://github.com/Aircoookie/WLED/blob/main/wled00/wled_server.cpp","tags":["third-party-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71264"},{"url":"https://github.com/advisories/GHSA-822p-39fj-m835"}],"sources":{"cve":[{"id":"CVE-2026-71264","title":"WLED Unauthenticated Configuration Disclosure via /json/cfg and Global Settings-PIN Lock State","description":"WLED's GET /json/cfg endpoint (registered in wled00/wled_server.cpp) calls serveJson with no settings-PIN check, unlike the /edit endpoint which explicitly checks correctPIN, disclosing the device's general configuration (network, hardware, LED setup) to any unauthenticated client on the network.","status":"published","published":"2026-08-05T12:26:12.31Z","modified":"2026-08-10T11:46:31.563Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:19:49.559463Z"}],"euvd":[{"id":"EUVD-2026-53349","description":"WLED's GET /json/cfg endpoint (registered in wled00/wled_server.cpp) calls serveJson with no settings-PIN check, unlike the /edit endpoint which explicitly checks correctPIN, disclosing the device's general configuration (network, hardware, LED setup) to any unauthenticated client on the network.","status":"published","published":"2026-08-05T12:26:12Z","modified":"2026-08-10T11:46:31Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T18:02:05.732685Z"}],"ghsa":[{"id":"GHSA-822p-39fj-m835","title":"WLED's GET /json/cfg endpoint (registered in wled00/wled_server.cpp) calls serveJson() with no...","description":"WLED's GET /json/cfg endpoint (registered in wled00/wled_server.cpp) calls serveJson() with no settings-PIN check, unlike the /edit endpoint which explicitly checks correctPIN, disclosing the device's general configuration (network, hardware, LED setup) to any unauthenticated client on the network. Separately, the settings-PIN unlock state is tracked via a single global boolean `correctPIN` (wled00/wled.h), not per-session state: once any single client submits the correct 4-digit PIN via POST /json, correctPIN becomes true for every client, granting all subsequent unauthenticated clients full configuration-write access (OTA firmware updates, WiFi reconfiguration, factory reset) until the device reboots.","status":"published","published":"2026-08-05T15:32:19Z","modified":"2026-08-05T15:32:23Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"high"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:10:07.328501Z"}],"nvd":[{"id":"CVE-2026-71264","description":"WLED's GET /json/cfg endpoint (registered in wled00/wled_server.cpp) calls serveJson with no settings-PIN check, unlike the /edit endpoint which explicitly checks correctPIN, disclosing the device's general configuration (network, hardware, LED setup) to any unauthenticated client on the network.","status":"published","published":"2026-08-05T13:24:50.6Z","modified":"2026-10-24T15:10:00.19Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:35.031043Z"}]}}