Approved changes feed: RSS · Atom
cpe:2.3:a:aircoookie:wled:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Aircoookie (55776bb5-324a-5842-9931-13b1a2264c0f) |
|---|---|
| Product | Wled (330b993f-7fda-549d-ae42-4fb7a29be21d) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-71264 |
vulnerable | 2026-09-16 04:32:59.214014 |
WLED Unauthenticated Configuration Disclosure via /json/cfg and Global Settings-PIN Lock State
HIGH (8.2)
WLED's GET /json/cfg endpoint (registered in wled00/wled_server.cpp) calls serveJson with no settings-PIN check, unlike the /edit endpoint which explicitly checks correctPIN, disclosing the device's general configuration (network, hardware, LED setup) to any unauthenticated client on the network.
Published: 2026-08-05T12:26:12.310Z
Updated: 2026-08-10T11:46:31.563Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.