by Kastro
Paper/Archive/CVE-2024-2862

CVE-2024-2862

LG Electronics LG LED Assistant — Password reset vulnerability without authorization on LG LED Assistant

EPSS 51%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 98.9.989 × 2019.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

This vulnerability allows remote attackers to reset the password of anonymous users without authorization on the affected LG LED Assistant.

Affected

ProductAffectedFixed inSource
LG LED Assistant2.1.65–CNA
lg_led_assistant2.1.65–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
LGE (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

reflgsecurity.lge.com/bulletins/idproducts#updateDetails