Information Disclosure in WLED LED Controller

Executive Summary

This vulnerability in WLED allows unauthenticated access to device configuration via the GET /json/cfg endpoint. It also exposes a flaw where a single correct PIN submission grants all subsequent unauthenticated clients full write access to settings, including firmware updates and WiFi reconfiguration, until the device reboots.

Useful 0 Not Useful 0

Detection Guidance

Check if unauthenticated requests to GET /json/cfg return sensitive configuration data. Use curl to query the endpoint: curl http://<device-ip>/json/cfg. If it returns network, hardware, or LED setup details without authentication, the device is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

An attacker on the same network could read sensitive device settings like network and LED configurations. If the PIN is guessed or previously submitted, they could also modify settings, install malicious firmware, or perform a factory reset, disrupting device functionality.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability may violate compliance requirements by exposing sensitive device configurations or allowing unauthorized modifications. GDPR could be impacted if personal data is exposed, while HIPAA may be affected if device settings relate to protected health information systems.

Useful 0 Not Useful 0

Mitigation Strategies

Restrict network access to the device via firewall rules or VLAN segmentation. Avoid using the device on untrusted networks. Monitor for unauthorized POST /json requests that may set correctPIN to true. Reboot the device to reset the global correctPIN state if compromised.

Useful 0 Not Useful 0