The vulnerability identified as CVE-2026-71264 affects Aircoookie WLED's GET /json/cfg endpoint. This endpoint calls serveJson without verifying the settings PIN, unlike the /edit endpoint which enforces PIN authentication. As a result, an unauthenticated attacker on the local network can retrieve the device's general configuration information, including network settings, hardware details, and LED setup. This represents a CWE-862 (Missing Authorization) issue. There is no vendor advisory or patch information available at this time.

An unauthenticated attacker on the same network can access sensitive device configuration data, potentially enabling further attacks or unauthorized device manipulation. The confidentiality of network and hardware configuration is compromised, but there is no direct indication of integrity or availability impact beyond information disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to trusted clients only and consider network segmentation to limit exposure of the device to untrusted users.