CVE-2026-71264
Received Received - Intake

Information Disclosure in WLED LED Controller

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
WLED's GET /json/cfg endpoint (registered in wled00/wled_server.cpp) calls serveJson() with no settings-PIN check, unlike the /edit endpoint which explicitly checks correctPIN, disclosing the device's general configuration (network, hardware, LED setup) to any unauthenticated client on the network. Separately, the settings-PIN unlock state is tracked via a single global boolean `correctPIN` (wled00/wled.h), not per-session state: once any single client submits the correct 4-digit PIN via POST /json, correctPIN becomes true for every client, granting all subsequent unauthenticated clients full configuration-write access (OTA firmware updates, WiFi reconfiguration, factory reset) until the device reboots.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-71264
EUVD
EUVD-2026-53349

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
wled wled *
aircoookie wled *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in WLED allows unauthenticated access to device configuration via the GET /json/cfg endpoint. It also exposes a flaw where a single correct PIN submission grants all subsequent unauthenticated clients full write access to settings, including firmware updates and WiFi reconfiguration, until the device reboots.

Detection Guidance

Check if unauthenticated requests to GET /json/cfg return sensitive configuration data. Use curl to query the endpoint: curl http://<device-ip>/json/cfg. If it returns network, hardware, or LED setup details without authentication, the device is vulnerable.

Impact Analysis

An attacker on the same network could read sensitive device settings like network and LED configurations. If the PIN is guessed or previously submitted, they could also modify settings, install malicious firmware, or perform a factory reset, disrupting device functionality.

Compliance Impact

This vulnerability may violate compliance requirements by exposing sensitive device configurations or allowing unauthorized modifications. GDPR could be impacted if personal data is exposed, while HIPAA may be affected if device settings relate to protected health information systems.

Mitigation Strategies

Restrict network access to the device via firewall rules or VLAN segmentation. Avoid using the device on untrusted networks. Monitor for unauthorized POST /json requests that may set correctPIN to true. Reboot the device to reset the global correctPIN state if compromised.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71264. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart