The GET /json/cfg endpoint in the Aircoookie WLED firmware lacks a settings‑PIN check, which means any device that can reach the API can retrieve the full device configuration. The disclosed data includes network interfaces, hardware details, and LED setup information, giving an attacker a clear picture of the device’s environment and capabilities. This weakness is a classic Missing Authentication/Authorization flaw (CWE‑862).

All releases of Aircoookie WLED firmware are impacted. The CVE description does not provide specific version identifiers, so every current build is assumed vulnerable until a new version incorporates proper PIN validation for the /json/cfg endpoint.

The vulnerability carries a CVSS score of 8.2, indicating high severity, but the EPSS score is listed as <1 %, suggesting a low probability of active exploitation at present. Because the attack only requires local network connectivity, any host on the same subnet can directly request /json/cfg and view the exposed configuration. The vulnerability is not present in the CISA KEV catalog, so it is not known to be widely exploited in the wild. Attackers who obtain the configuration could use the information for future attacks, such as network reconnaissance or device hijacking, but the current data do not indicate any confirmed exploitation.