The vulnerability in Aircoookie WLED involves the GET /json/cfg endpoint which serves device configuration data without requiring a settings PIN, unlike the /edit endpoint that enforces PIN verification. Furthermore, the device tracks the settings-PIN unlock state using a single global boolean variable 'correctPIN' rather than per-session authentication. Once any client submits the correct 4-digit PIN via POST /json, the 'correctPIN' flag is set to true globally, granting all subsequent unauthenticated clients full write access to configuration functions such as OTA firmware updates, WiFi reconfiguration, and factory reset until the device reboots. This design flaw leads to unauthorized disclosure of configuration data and persistent unauthorized configuration access.

An unauthenticated attacker on the same network can retrieve sensitive device configuration information and, after one successful PIN authentication by any client, gain persistent full configuration write access without further authentication. This includes the ability to perform OTA firmware updates, change WiFi settings, and factory reset the device, potentially leading to device compromise or disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to trusted clients only and avoid exposing the device on untrusted networks. Monitor vendor communications for official patches or updates addressing this vulnerability.