Advisories · Technology
ModelTC LightLLM.
Every CVE that names ModelTC LightLLM among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.7 High
LightLLM through 1.2.0 Unauthenticated DoS via pd_kv_trans_params Deserialization
- ModelTC LightLLM
- Insecure deserialization
- CVSS 9.3 CriticalCritical · CVSS 9+
LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Visual-Only RPyC Service
- ModelTC LightLLM
- Insecure deserialization
- CVSS 8.7 High
LightLLM through 1.2.0 Missing Authentication on RL Control Routes
- ModelTC LightLLM
- Authentication bypass
- CVSS 6.9 Medium
LightLLM through 1.2.0 Server-Side Request Forgery via multimodal endpoints
- ModelTC LightLLM
- Server-side request forgery (SSRF)
- CVSS 8.7 High
LightLLM through 1.2.0 Unauthenticated Memory Exhaustion via NCCL Control Channel set_value
- ModelTC LightLLM
- Denial of service
- CVSS 9.3 CriticalCritical · CVSS 9+
LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Embed Cache RPyC Service
- ModelTC LightLLM
- Insecure deserialization
- CVSS 9.3 CriticalCritical · CVSS 9+
LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Router Profiler RPyC Service
- ModelTC LightLLM
- Insecure deserialization
- CVSS 9.3 CriticalCritical · CVSS 9+
LightLLM through 1.2.0 Unauthenticated Remote Code Execution via NCCL PD RPyC Control Channel
- ModelTC LightLLM
- Insecure deserialization
- CVSS 9.3 CriticalCritical · CVSS 9+
LightLLM through 1.2.0 Missing Authentication in PD Master /pd_register WebSocket Endpoint
- ModelTC LightLLM
- Authentication bypass
- CVSS 9.3 CriticalCritical · CVSS 9+
LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Config Server Pickle Deserialization
- ModelTC LightLLM
- Insecure deserialization
- CVSS 9.3 CriticalCritical · CVSS 9+
LightLLM <= 1.1.0 PD Mode Unsafe Deserialization RCE
- ModelTC LightLLM
- Insecure deserialization