CVE-2024-2862 is a Critical severity (CVSS 9.1) authentication flaw in LG LED Assistant that lets remote attackers reset the password of anonymous users without authorization. The record lists no versions. Check the LG security bulletin for the fixed release and apply it.
What's affected
- Product: LG LED Assistant, LG's software for managing LED displays.
- Affected versions: not stated in the record.
- Fixed versions: not stated in the record. The LG bulletin page was fetched but returned no readable detail for us, so check LG's security bulletins directly.
- Weakness: CWE-287 and CWE-640.
- Access needed: no account over the network (CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H).
How to check if you're exposed
- Find where LG LED Assistant is installed or hosted in your organisation, including digital signage controllers.
- Read its version from the application.
- Open the LG security bulletin at https://lgsecurity.lge.com/bulletins/idproducts and look for these CVE IDs.
- Check whether the service is reachable from the internet. If it is, treat the fix as urgent.
What to do now
- Locate every LG LED Assistant instance.
- Check the LG bulletin for the fixed release.
- Update, and confirm the new version.
- Keep the service off the public internet until it is updated.
- Review accounts for unexpected password changes.
Why it matters
Improper authentication means a system does not correctly confirm that the caller is who they claim to be. Paired with a weak password recovery flow, it can let someone take over an account that is not theirs.
A weak password recovery mechanism lets someone reset a credential without proving ownership of the account.
Password reset paths deserve the same scrutiny as login itself, since they are an alternative way in.
The two CVEs for this product were published together on 25 March 2024. The password reset flaw is scored 9.1 because it needs no account and can change credentials.
KEV status: the record has the CISA Known Exploited Vulnerabilities flag set to false, and none of the sources we could read says this is exploited in the wild. That can change, so watch for updates.
Try it yourself
Password reset endpoints are a classic API testing target. The API scan demo shows what such a check looks like.
Click through it at your own pace, or open it full screen.
Quick check
Which versions are affected?
The record does not say. Use the LG bulletin.
Is it exploited in the wild?
The record has the KEV flag as false and we found no source saying so.
Sources
Record reference (the page was fetched but gave no usable detail):
Last reviewed: 19 October 2026.
