logitech: "Options" Craft WebSocket server has no authentication - your keyboard can be remotely controlled by javascript in webpages!

[GoodBytes]

2 hours ago, Arokhantos said:

Should i be worried if i have just a logitech mice and no keyboard from Logitech ?

If you are not customizing the Logitech Mouse, nor using Logitech Flow feature (for the supported peripherals), then you can remove the software

[GoodBytes]

20 minutes ago, Arokhantos said:

 

Never heard of that using this still, hate the new Logitech software.

 

This is not Logitech Options, you are safe (from what we know)

[Questargon]

A new version of Options has just been released. Logitech added additional origin checks to prevent misuse of that websocket. See the thread in Project-Zero: https://bugs.chromium.org/p/project-zero/issues/detail?id=1663

EDIT: The OP of that thread has not reacted yet though, so you might want to wait until he also says that it is ok now.

EDIT2: Bug is fixed.