HIGHVulnerability
CVE-2026-71264
WLED's GET /json/cfg endpoint (registered in wled00/wled_server.cpp) calls serveJson with no settings-PIN check, unlike the /edit endpoint which explicitly checks correctPIN, disclosing the device's general configuration (network, hardware, LED setup) to any unauthenticated client on the network.
Properties
- severity
- HIGH
- score
- 8.2
- cve_id
- CVE-2026-71264
- vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
- published_at
- 2026-08-05T13:24:50.600
- last_modified
- 2026-08-26T17:13:24.800
Related Entities (2)
HAS_WEAKNESS (1)
→[Weakness]Missing Authorization
DESCRIBED_BY (1)
→[Source]NVD
Explore deeper with Ninja Signal's threat intelligence graph