Wled
Monthly
Unauthenticated network access to WLED's GET /json/cfg endpoint exposes full device configuration - including network credentials, hardware layout, and LED setup - to any client on the same network, while a separate global-state authentication flaw in wled.h allows any attacker who submits the correct 4-digit PIN via POST /json to instantly grant full write access to all subsequent unauthenticated clients until the device reboots. The write-access window enables critical operations including OTA firmware flashing, WiFi reconfiguration, and factory reset. No public exploit code or CISA KEV listing has been identified at time of analysis, but the 10,000-combination PIN space with no described rate-limiting makes the authentication bypass trivially automatable against any network-reachable WLED instance.
Unauthenticated network access to WLED's GET /json/cfg endpoint exposes full device configuration - including network credentials, hardware layout, and LED setup - to any client on the same network, while a separate global-state authentication flaw in wled.h allows any attacker who submits the correct 4-digit PIN via POST /json to instantly grant full write access to all subsequent unauthenticated clients until the device reboots. The write-access window enables critical operations including OTA firmware flashing, WiFi reconfiguration, and factory reset. No public exploit code or CISA KEV listing has been identified at time of analysis, but the 10,000-combination PIN space with no described rate-limiting makes the authentication bypass trivially automatable against any network-reachable WLED instance.