Lg Electronics Lg-Led Assistant vulnerabilities
4 known vulnerabilities affecting lg_electronics/lg-led_assistant.
Total CVEs
4
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL2HIGH2
Vulnerabilities
Page 1 of 1
CVE-2023-4614P2CRITICALCVSS 9.8v2.1.452023-09-04
CVE-2023-4614 [CRITICAL] CWE-22 CVE-2023-4614: This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG
This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/installation/setThumbnailRc endpoint. The issue results from the lack of proper validation of a user-supplied path prior to using it
nvd
CVE-2023-4613P2CRITICALCVSS 9.8v2.1.452023-09-04
CVE-2023-4613 [CRITICAL] CWE-22 CVE-2023-4613: This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG
This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/settings/upload endpoint. The issue results from the lack of proper validation of a user-supplied path prior to using it in file oper
nvd
CVE-2023-4615P3HIGHCVSS 7.5v2.1.452023-09-04
CVE-2023-4615 [HIGH] CWE-22 CVE-2023-4615: This vulnerability allows remote attackers to disclose sensitive information on affected installatio
This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/download/updateFile endpoint. The issue results from the lack of proper validation of a user-supplied path prior to using it in f
nvd
CVE-2023-4616P3HIGHCVSS 7.5v2.1.452023-09-04
CVE-2023-4616 [HIGH] CWE-22 CVE-2023-4616: This vulnerability allows remote attackers to disclose sensitive information on affected installatio
This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/thumbnail endpoint. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operat
nvd