CVE-2026-71264 Details
Description
WLED's GET /json/cfg endpoint (registered in wled00/wled_server.cpp) calls serveJson with no settings-PIN check, unlike the /edit endpoint which explicitly checks correctPIN, disclosing the device's general configuration (network, hardware, LED setup) to any unauthenticated client on the network.
A vulnerability in WLED firmware for ESP32 microcontrollers allows unauthenticated clients to access the device's general configuration, including network, hardware, and LED setup. This issue arises because the GET /json/cfg endpoint does not require a settings-PIN, unlike the /edit endpoint, which does. The vulnerability enables any unauthenticated client on the network to retrieve sensitive configuration information. Furthermore, once an authenticated client submits the correct 4-digit PIN via POST /json, all subsequent unauthenticated clients gain full configuration-write access until the device is rebooted.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 5, 2026CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Aircoookie/WLED | TuranSec | Vendor |
| https://github.com/Aircoookie/WLED/blob/main/wled00/wled_server.cpp | TuranSec | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | TuranSec |
Affected Products
| Product | Versions |
|---|---|
| WLED | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 10, 2026 | CVE Modified | TuranSec |
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | New CVE Received | TuranSec |