Description
A Cross-Site Request Forgery (CSRF) in Elgato's Key Lights and related light products allows an attacker to host a malicious webpage that remotely controlles the victim's lights.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Elgato | Key Light | ≤ 1.0.3(218) | — |
| Elgato | Key Light Air | ≤ 1.0.3.220 | — |
| Elgato | Key Light Mini | ≤ 1.0.4.239 | — |
| Elgato | Key Light Neo | ≤ 1.0.4.206 | — |
| Elgato | Ring Light | ≤ 1.0.4.149 | — |
| Elgato | Light Strip | ≤ 1.0.4.231 | — |
| Elgato | Light Strip Pro | ≤ 1.0.1.145 | — |