CVE-2023-4614

This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/installation/setThumbnailRc endpoint. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user.

• CWE-22
• CWE-22

• https://lgsecurity.lge.com/bulletins/idproducts#updateDetailsVendor Advisory
• https://www.zerodayinitiative.com/advisories/ZDI-23-1222/Third Party Advisory, VDB Entry
• https://lgsecurity.lge.com/bulletins/idproducts#updateDetailsVendor Advisory
• https://www.zerodayinitiative.com/advisories/ZDI-23-1222/Third Party Advisory, VDB Entry

Published

Sep 4, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-46134D-Tale is the combination of a Flask back-end and a React fr…9.8
• CVE-2023-46135rs-stellar-strkey is a Rust lib for encode/decode of Stellar…7.5
• CVE-2023-46136Werkzeug is a comprehensive WSGI web application library. In…7.5
• CVE-2023-46137Twisted is an event-based framework for internet application…5.3
• CVE-2023-46138JumpServer is an open source bastion host and maintenance se…5.3
• CVE-2023-46139KernelSU is a Kernel based root solution for Android. Starti…5.7
• CVE-2023-46141Incorrect Permission Assignment for Critical Resource vulner…9.8
• CVE-2023-46142A incorrect permission assignment for critical resource vuln…8.8
• CVE-2023-46143Download of Code Without Integrity Check vulnerability in PH…7.5
• CVE-2023-46144A download of code without integrity check vulnerability in …6.5
• CVE-2023-46145Improper Privilege Management vulnerability in Themify Themi…8.8
• CVE-2023-46146Missing Authorization vulnerability in Themify Themify Ultra…8.8