CVE-2026-71264

WLED Unauthenticated Configuration Disclosure via /json/cfg and Global Settings-PIN Lock State

Published Aug 5, 2026 CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Description

WLED's GET /json/cfg endpoint (registered in wled00/wled_server.cpp) calls serveJson with no settings-PIN check, unlike the /edit endpoint which explicitly checks correctPIN, disclosing the device's general configuration (network, hardware, LED setup) to any unauthenticated client on the network.

Analysis

Technical impact

The GET /json/cfg endpoint in the Aircoookie WLED firmware lacks a settings‑PIN check, which means any device that can reach the API can retrieve the full device configuration. The disclosed data includes network interfaces, hardware details, and LED setup information, giving an attacker a clear picture of the device’s environment and capabilities. This weakness is a classic Missing Authentication/Authorization flaw (CWE‑862).

Affected Systems

All releases of Aircoookie WLED firmware are impacted. The CVE description does not provide specific version identifiers, so every current build is assumed vulnerable until a new version incorporates proper PIN validation for the /json/cfg endpoint.

Risk and Exploitability

The vulnerability carries a CVSS score of 8.2, indicating high severity, but the EPSS score is listed as <1 %, suggesting a low probability of active exploitation at present. Because the attack only requires local network connectivity, any host on the same subnet can directly request /json/cfg and view the exposed configuration. The vulnerability is not present in the CISA KEV catalog, so it is not known to be widely exploited in the wild. Attackers who obtain the configuration could use the information for future attacks, such as network reconnaissance or device hijacking, but the current data do not indicate any confirmed exploitation.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Aircoookie

WLED

unaffected

Version	Status	Constraints
`0`	affected	≤ *

No data.

Vendor Product Versions

Aircoookie

Wled

Version	Status	Scheme	Platform
`[0,*]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the WLED firmware to the latest release that implements PIN checks on the /json/cfg endpoint.
Limit access to the device’s API by applying firewall rules, VLAN segmentation, or network isolation so that only trusted hosts can reach it.
If a trusted firmware update is not immediately available, reset the device to factory defaults, set a strong, unique four‑digit PIN, and consider placing the device behind a VPN or within a secured Wi‑Fi network to reduce exposure.

Generated by OpenCVE AI on August 10, 2026 at 21:05 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.334% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/Aircoookie/WLED
https://github.com/Aircoookie/WLED/blob/main/wled00/wled_server.cpp

History

Aug 10, 2026 12:00 PM Description updated. Title updated View changes

Type	Values Removed	Values Added
Description	WLED's GET /json/cfg endpoint (registered in wled00/wled_server.cpp) calls serveJson() with no settings-PIN check, unlike the /edit endpoint which explicitly checks correctPIN, disclosing the device's general configuration (network, hardware, LED setup) to any unauthenticated client on the network. Separately, the settings-PIN unlock state is tracked via a single global boolean `correctPIN` (wled00/wled.h), not per-session state: once any single client submits the correct 4-digit PIN via POST /json, correctPIN becomes true for every client, granting all subsequent unauthenticated clients full configuration-write access (OTA firmware updates, WiFi reconfiguration, factory reset) until the device reboots.	WLED's GET /json/cfg endpoint (registered in wled00/wled_server.cpp) calls serveJson with no settings-PIN check, unlike the /edit endpoint which explicitly checks correctPIN, disclosing the device's general configuration (network, hardware, LED setup) to any unauthenticated client on the network.
Title	WLED - Unauthenticated Configuration Disclosure via /json/cfg and Global Settings-PIN Lock State	WLED Unauthenticated Configuration Disclosure via /json/cfg and Global Settings-PIN Lock State

Aug 10, 2026 11:45 AM Title updated View changes

Type	Values Removed	Values Added
Title	WLED Unauthenticated Configuration Disclosure via /json/cfg and Global Settings-PIN Lock State	WLED - Unauthenticated Configuration Disclosure via /json/cfg and Global Settings-PIN Lock State

Aug 7, 2026 10:30 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Aircoookie Aircoookie wled
Vendors & Products		Aircoookie Aircoookie wled

Aug 5, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 5, 2026 1:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		WLED's GET /json/cfg endpoint (registered in wled00/wled_server.cpp) calls serveJson() with no settings-PIN check, unlike the /edit endpoint which explicitly checks correctPIN, disclosing the device's general configuration (network, hardware, LED setup) to any unauthenticated client on the network. Separately, the settings-PIN unlock state is tracked via a single global boolean `correctPIN` (wled00/wled.h), not per-session state: once any single client submits the correct 4-digit PIN via POST /json, correctPIN becomes true for every client, granting all subsequent unauthenticated clients full configuration-write access (OTA firmware updates, WiFi reconfiguration, factory reset) until the device reboots.
Title		WLED Unauthenticated Configuration Disclosure via /json/cfg and Global Settings-PIN Lock State
Weaknesses		CWE-862
References		https://github.com/Aircoookie/WLED https://github.com/Aircoookie/WLED/blob/main/wled00/wled_server.cpp
Metrics		cvssV3_1 `{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N'}`