Login Request a demo
Critical severity · published Sep 4, 2023
CVE-2023-4614
This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG LED Assistant
9.8
CVSS
2.5%
EPSS
No
On KEV
Description
This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/installation/setThumbnailRc endpoint. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.5% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LL
LG Led Assistant · LG
2.1.45 · source: NVD
Affected product
LL
LG Led Assistant
LG
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-4614
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-4614
Vendor Advisory
https://lgsecurity.lge.com/bulletins/idproducts#updateDetails
Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-23-1222/
More from LG Led Assistant
9.8
CVE-2024-2863
This vulnerability allows remote attackers to traverse paths via file upload on the affected LG LED Assistant
9.8
CVE-2024-2862
This vulnerability allows remote attackers to reset the password of anonymous users without authorization on the affected LG LED Assistant
9.8
CVE-2023-4613
This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG LED Assistant
7.5
CVE-2023-4616
This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG LED Assistant
7.5
CVE-2023-4615
This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG LED Assistant