What is the CVSS score of EUVD-2026-53349?

EUVD-2026-53349 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of WLED are affected by EUVD-2026-53349?

WLED devices face immediate credential exposure and unauthenticated remote code execution risk through unpatched configuration disclosure and trivially-bypassable PIN authentication-no public exploit…

How to fix or mitigate EUVD-2026-53349?

Immediately (within 24 hours): conduct network inventory of all WLED devices and assess which are accessible from untrusted segments; document all instances and their network exposure. Within 7 days: implement VLAN isolation, firewall rules, or air-gapping to restrict WLED access to authorized users only; change all device PINs from defaults and deploy network-level rate-limiting on POST /json endpoints if your infrastructure supports it. Within 30 days: monitor vendor security advisories for a patch release and prepare staged firmware updates for all affected instances; for devices remaining unpatched beyond 60 days without viable isolation, plan replacement with patched WLED versions or alternative lighting-control products.

WLED EUVD-2026-53349

| CVE-2026-71264 HIGH

Missing Authorization (CWE-862)

2026-08-05 TuranSec

GHSA-822p-39fj-m835

Authentication Bypass Wled

8.2

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

vuln.today AI

8.2 HIGH

Network HTTP API, no credentials required by attacker; 4-digit PIN brute-force is low complexity; high integrity from OTA firmware write; no direct availability impact stated.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 13:34 vuln.today

CVE Published

Aug 05, 2026 - 12:26 cve.org

HIGH 8.2

DescriptionCVE.org

WLED's GET /json/cfg endpoint (registered in wled00/wled_server.cpp) calls serveJson() with no settings-PIN check, unlike the /edit endpoint which explicitly checks correctPIN, disclosing the device's general configuration (network, hardware, LED setup) to any unauthenticated client on the network. Separately, the settings-PIN unlock state is tracked via a single global boolean correctPIN (wled00/wled.h), not per-session state: once any single client submits the correct 4-digit PIN via POST /json, correctPIN becomes true for every client, granting all subsequent unauthenticated clients full configuration-write access (OTA firmware updates, WiFi reconfiguration, factory reset) until the device reboots.

AnalysisAI

Unauthenticated network access to WLED's GET /json/cfg endpoint exposes full device configuration - including network credentials, hardware layout, and LED setup - to any client on the same network, while a separate global-state authentication flaw in wled.h allows any attacker who submits the correct 4-digit PIN via POST /json to instantly grant full write access to all subsequent unauthenticated clients until the device reboots. The write-access window enables critical operations including OTA firmware flashing, WiFi reconfiguration, and factory reset. No public exploit code or CISA KEV listing has been identified at time of analysis, but the 10,000-combination PIN space with no described rate-limiting makes the authentication bypass trivially automatable against any network-reachable WLED instance.

Technical ContextAI

WLED (cpe:2.3:a:aircoookie:wled:*:*:*:*:*:*:*:*) is open-source firmware for ESP8266/ESP32 microcontrollers that drives addressable LED strips (WS2812B, SK6812, etc.) via a built-in HTTP JSON API. Two distinct flaws are present in the codebase. First, the route registered for GET /json/cfg in wled00/wled_server.cpp calls serveJson() without invoking the correctPIN guard that the /edit endpoint explicitly enforces - a textbook CWE-862 (Missing Authorization) failure where the access-control check exists in the system but is inconsistently applied across routes. Second, the authentication unlock mechanism stores its state in a single process-global boolean named correctPIN in wled00/wled.h with no session binding, no per-client tracking, and no IP scoping. Once any HTTP client causes correctPIN to become true, every concurrent and subsequent HTTP client inherits that unlocked state until the firmware reboots. This design treats the PIN as a device-mode toggle rather than a per-session credential, an approach that may have been adequate for single-user local serial access but is fundamentally unsafe in a networked, multi-client HTTP context.

RemediationAI

No patched release version is confirmed in the available reference data - the references link only to the upstream repository (https://github.com/Aircoookie/WLED) and the specific source file (https://github.com/Aircoookie/WLED/blob/main/wled00/wled_server.cpp) without pointing to a fix commit or tagged release. Users should monitor the WLED GitHub repository for a patch addressing both the missing PIN check on GET /json/cfg and the global-scope correctPIN state. Until a patch is available, network-layer isolation is the most effective compensating control: place WLED devices on a dedicated firewalled IoT VLAN with no inbound access from untrusted segments, limiting the attacker pool to co-resident LAN clients only. Enabling AP client isolation on the Wi-Fi access point prevents direct client-to-client communication within the same SSID, further constraining reachability. If the firmware build supports HTTP ACLs or bind-address restrictions, limit the HTTP listener to trusted source IPs. Note that network segmentation does not remediate the global-state flaw if a legitimate administrator session coexists on the same segment as an attacker - the attacker would inherit write access the moment an admin authenticates.