CVE-2023-4615

This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/download/updateFile endpoint. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of the current user.

• CWE-22
• CWE-22

• https://lgsecurity.lge.com/bulletins/idproducts#updateDetailsVendor Advisory
• https://www.zerodayinitiative.com/advisories/ZDI-23-1224/Third Party Advisory, VDB Entry
• https://lgsecurity.lge.com/bulletins/idproducts#updateDetailsVendor Advisory
• https://www.zerodayinitiative.com/advisories/ZDI-23-1224/Third Party Advisory, VDB Entry

Published

Sep 4, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-46144A download of code without integrity check vulnerability in …6.5
• CVE-2023-46145Improper Privilege Management vulnerability in Themify Themi…8.8
• CVE-2023-46146Missing Authorization vulnerability in Themify Themify Ultra…8.8
• CVE-2023-46147Deserialization of Untrusted Data vulnerability in Themify T…8.8
• CVE-2023-46148Missing Authorization vulnerability in Themify Themify Ultra…8.8
• CVE-2023-46149Unrestricted Upload of File with Dangerous Type vulnerabilit…8.8
• CVE-2023-46150Cross-Site Request Forgery (CSRF) vulnerability in WP Milita…8.8
• CVE-2023-46151Cross-Site Request Forgery (CSRF) vulnerability in AWESOME T…8.8
• CVE-2023-46152Cross-Site Request Forgery (CSRF) vulnerability in realmag77…8.8
• CVE-2023-46153Unauth. Stored Cross-Site Scripting (XSS) vulnerability in U…6.1
• CVE-2023-46154Deserialization of Untrusted Data vulnerability in E2Pdf.Com…7.2
• CVE-2023-46156Affected devices improperly handle specially crafted packets…7.5