Three security vulnerabilities in LG's webOS operating system could allow attackers to gain complete control of certain LG smart TVs without authentication or any action from the owner. The flaws can be combined to obtain root access when an attacker is connected to the same local network as the television.
LG has released a firmware fix for the vulnerabilities, following their disclosure by SSD Secure Disclosure on October 12. Users are advised to check their devices for available software updates.
Models impacted
Researchers tested the vulnerability chain on two LG television models: the 32LQ636BPSA and the 27TQ600SW. Both devices were running webOS version 7.5.7-25 with firmware 04.54.40. It remains unclear whether other models or firmware versions are affected.
The attack begins by targeting a network service on port 3001, which is used by the LG ThinQ application to pair with televisions. Researchers found that an attacker could exploit a built-in application called sync-demo to bypass the normal pairing PIN requirement and obtain a privileged key.
Using this key, the attacker can launch another preinstalled application, known as cmp-client, and direct it to a webpage controlled by the attacker. The application does not properly restrict where it can navigate, allowing the malicious webpage to access an internal webOS interface called PalmServiceBridge.
This interface provides communication with system services. Researchers found that it could be used to reach pmlogd, a system logging service that operates with root privileges. Because the service does not properly validate certain input, an attacker can inject shell commands that are executed with the highest level of access on the television.
The combined vulnerabilities therefore allow an attacker to move from an unauthenticated network connection to root-level control without requiring the television owner to enter a PIN, approve a request or click a link.
What is at risk?
Root access can give attackers extensive control over an affected television. Depending on the device configuration and the attacker's actions, this could enable unauthorised software execution, system manipulation and potential exposure of information stored on the device.
The disclosure was demonstrated by an anonymous researcher who secured third place in the LG webOS category at the TyphoonPWN 2026 security competition in Seoul. No CVE identifiers have been assigned to these newly disclosed flaws, and no exploitation in the wild has been reported.
Read the original article: