LG AC Smart II Unauthorized Password Change Vulnerability

A vulnerability exists in LG AC Smart II that allows for unauthorized password changes. The issue arises from a hidden form on the password reset page for administrators. Attackers can use developer tools to reveal and interact with this form, changing the administrator password without any login verification or consideration of user permissions.

Impact

Exploitation of this vulnerability allows for unauthorized changes to the administrator password, potentially leading to unauthorized administrative access.