An unauthenticated broken access control flaw in the WLED configuration endpoint exposes the device to unauthorized settings modification.

This vulnerability (CWE-862) exists within the /json/cfg endpoint. It permits an unauthenticated attacker to perform unauthorized configuration changes, which could lead to full control over the device settings.

The CVSS score of 8.2 highlights a high risk of unauthorized configuration manipulation. In an industrial or commercial lighting environment, this could lead to service disruption, device bricking, or the use of compromised devices as a pivot point within the internal network.

Immediate Action: Review the official WLED project repository for security guidance and apply any available firmware updates. If no update is available, restrict access to the WLED interface to trusted network segments only.

Proactive Monitoring: Monitor network traffic to the WLED device for unauthorized access to the /json/cfg endpoint.

Compensating Controls: Place the device on an isolated VLAN with no direct access from the public internet or untrusted internal segments.

Public Exploit Available: No confirmed public exploit is available in the provided data.

Users of WLED should prioritize network-level isolation for these devices until a formal patch is applied. The lack of authentication on the configuration endpoint is a severe security oversight that must be mitigated by restricting network exposure as a primary defense.