CVE-2026-71264

Summary

The flaw allows unauthenticated access to the device's configuration details via the GET /json/cfg endpoint, exposing sensitive information such as network settings and LED configurations.

Exploitability

Exploitation is relatively easy given that no authentication is required; an attacker on the same network can directly access this endpoint.

Blast radius

If exploited, attackers could gain insights into the device's setup, potentially leading to further attacks or unauthorized control of the device.

Prioritized remediation

Implement proper authentication checks for all configuration endpoints to prevent unauthorized access.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.