LG LED Assistant - Authentication Bypass (CVE-2024-2862)
Description
This vulnerability allows remote attackers to reset the password of anonymous users without authorization on the affected LG LED Assistant.
psychologyCrowdSec Analysis
CVE-2024-2862 is a high-severity vulnerability in LG LED Assistant that allows remote attackers to reset the passwords of anonymous users without authorization. This flaw could be exploited to disrupt user access or facilitate further attacks by manipulating account credentials.
CrowdSec has been tracking this vulnerability and its exploits since 7th of January 2026.
CrowdSec has not observed any significant exploitation activity targeting CVE-2024-2862 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers exploit the /api/changePw endpoint by spoofing the X-Forwarded-For header with 127.0.0.1 to perform unauthenticated password resets. This technique targets password reset functionality and can lead to unauthorized account access.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2024-03-25 |
| Rule Released | 2026-01-07 |
| CrowdSec First Seen | 2026-02-01 |
Related Weaknesses
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.