CVE-2024-2862

Password reset vulnerability without authorization on LG LED Assistant

This vulnerability allows remote attackers to reset the password of anonymous users without authorization on the affected LG LED Assistant.

Affected

LG Electronics · LG LED Assistant

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 LGE

9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

EPSS

51.00% chance of exploitation in the next 30 days, 99th percentile

Nuclei

high · CWE-640

Published

2024-03-25

Updated

2024-08-28

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-2862.yaml

Security advisories

• https://lgsecurity.lge.com/bulletins/idproducts#updateDetails

References

• CVE Record
• NVD entry