https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-11T02:24:16.323219+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-71264 CVE-2026-71264 — WLED Unauthenticated Configuration Disclosure via /json/cfg and Global Settings-PIN Lock State 2026-10-11T02:24:16.324794+00:00

Affected: Aircoookie WLED

WLED's GET /json/cfg endpoint (registered in wled00/wled_server.cpp) calls serveJson with no settings-PIN check, unlike the /edit endpoint which explicitly checks correctPIN, disclosing the device's general configuration (network, hardware, LED setup) to any unauthenticated client on the network.