CVE-2024-2863 is a Medium severity (CVSS 5.3) path traversal flaw in LG LED Assistant that lets remote attackers traverse paths through file upload. The record lists no versions. Check the LG security bulletin for the fixed release and apply it.
What's affected
- Product: LG LED Assistant, LG's software for managing LED displays.
- Affected versions: not stated in the record.
- Fixed versions: not stated in the record. The LG bulletin page was fetched but returned no readable detail for us, so check LG's security bulletins directly.
- Weakness: CWE-35 and CWE-22.
- Access needed: no account over the network (CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
How to check if you're exposed
- Find where LG LED Assistant is installed or hosted in your organisation, including digital signage controllers.
- Read its version from the application.
- Open the LG security bulletin at https://lgsecurity.lge.com/bulletins/idproducts and look for these CVE IDs.
- Check whether the service is reachable from the internet. If it is, treat the fix as urgent.
What to do now
- Locate every LG LED Assistant instance.
- Check the LG bulletin for the fixed release.
- Update, and confirm the new version.
- Keep the service off the public internet until it is updated.
- Review uploaded files for unexpected names or locations.
Why it matters
This weakness is the path traversal variant that uses a pair of dots and a slash to climb out of the intended directory.
Path traversal lets a request reach files outside the directory the application meant to expose, typically through manipulated file names or paths.
It is closely related to the general path traversal class, and the fix is the same: canonicalise the path and check it against the allowed base.
Both CVEs for this product were published together on 25 March 2024. This one is scored lower because the vector shows limited impact, but file upload bugs can combine with other flaws.
KEV status: the record has the CISA Known Exploited Vulnerabilities flag set to false, and none of the sources we could read says this is exploited in the wild. That can change, so watch for updates.
Quick check
Which versions are affected?
The record does not say. Use the LG bulletin.
Is it exploited in the wild?
The record has the KEV flag as false and we found no source saying so.
Sources
Record reference (the page was fetched but gave no usable detail):
Last reviewed: 19 October 2026.
