CVE-2024-2862 PoC — Password reset vulnerability without authorization on LG LED Assistant

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-2862.yaml

Associated Vulnerability

Title:Password reset vulnerability without authorization on LG LED Assistant (CVE-2024-2862)
Description: This vulnerability allows remote attackers to reset the password of anonymous users without authorization on the affected LG LED Assistant.

Description

The /api/changePw endpoint in LG LED Assistant allows unauthenticated password resets when requests are considered to come from localhost. An attacker can spoof the X-Forwarded-For header with value 127.0.0.1 to trigger the behavior and receive a success response.

File Snapshot

Log in to view the POC file snapshot cached by Shenlong Bot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →