Lg Led Assistant vulnerabilities
6 vulnerabilities
Known vulnerabilities in Lg Led Assistant, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CriticalCVE-2024-2862lg electronics · lg led assistant +1 morePassword reset vulnerability without authorization on LG LED AssistantThis vulnerability allows remote attackers to reset the password of anonymous users without authorization on the affected LG LED Assistant.EPSS51.00%CriticalCVE-2024-2863lg electronics · lg led assistant +1 morePath traversal via file upload on LG LED AssistantThis vulnerability allows remote attackers to traverse paths via file upload on the affected LG LED Assistant.EPSS64.00%CriticalCVE-2023-4613lg electronics · lg-led assistant +1 moreUpload Directory Path Traversal Allows Unauthenticated Arbitrary File Read VulnerabilityThis vulnerability allows remote attackers to execute arbitrary code on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/settings/upload endpoint. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user.EPSS2.55%HighCVE-2023-4616lg electronics · lg-led assistant +1 morethumbnail Directory Path Traversal Allows Unauthenticated Arbitrary File Read VulnerabilityThis vulnerability allows remote attackers to disclose sensitive information on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/thumbnail endpoint. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of the current user.EPSS1.61%CriticalCVE-2023-4614lg electronics · lg-led assistant +1 moresetThumbnailRC Directory Path Traversal Allows Unauthenticated Arbitrary File Read VulnerabilityThis vulnerability allows remote attackers to execute arbitrary code on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/installation/setThumbnailRc endpoint. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user.EPSS2.50%HighCVE-2023-4615lg electronics · lg-led assistant +1 moreupdateFile Directory Path Traversal Allows Unauthenticated Arbitrary File Read VulnerabilityThis vulnerability allows remote attackers to disclose sensitive information on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/download/updateFile endpoint. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of the current user.EPSS1.61%