CVE-2023-4616

This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/thumbnail endpoint. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of the current user.

• CWE-22
• CWE-22

• https://lgsecurity.lge.com/bulletins/idproducts#updateDetailsVendor Advisory
• https://www.zerodayinitiative.com/advisories/ZDI-23-1223/Third Party Advisory, VDB Entry
• https://lgsecurity.lge.com/bulletins/idproducts#updateDetailsVendor Advisory
• https://www.zerodayinitiative.com/advisories/ZDI-23-1223/Third Party Advisory, VDB Entry

Published

Sep 4, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-46153Unauth. Stored Cross-Site Scripting (XSS) vulnerability in U…6.1
• CVE-2023-46154Deserialization of Untrusted Data vulnerability in E2Pdf.Com…7.2
• CVE-2023-46156Affected devices improperly handle specially crafted packets…7.5
• CVE-2023-46157File-Manager in MGT CloudPanel 2.0.0 through 2.3.2 allows th…8.8
• CVE-2023-46158IBM WebSphere Application Server Liberty 23.0.0.9 through 23…9.8
• CVE-2023-46159IBM Storage Ceph 5.3z1, 5.3z5, and 6.1z1 could allow an auth…6.5
• CVE-2023-46167IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Se…7.5
• CVE-2023-46169 IBM DS8900F HMC 89.21.19.0, 89.21.31.0, 89.30.68.0, 89.32.4…6.5
• CVE-2023-4617Incorrect authorization vulnerability in HTTP POST method in…10
• CVE-2023-46170IBM DS8900F HMC 89.21.19.0, 89.21.31.0, 89.30.68.0, 89.32.40…6.5
• CVE-2023-46171IBM DS8900F HMC 89.21.19.0, 89.21.31.0, 89.30.68.0, 89.32.40…4.3
• CVE-2023-46172IBM DS8900F HMC 89.21.19.0, 89.21.31.0, 89.30.68.0, 89.32.40…9.8