As reported by The Hacker News, a researcher demonstrated a three-vulnerability chain in LG's webOS that yields pre-authenticated root access from the local network — no PIN, no user interaction, no CVEs assigned. LG has issued a firmware fix following an advisory from SSD Secure Disclosure. While the exploit was demonstrated on two TV models (32LQ636BPSA and 27TQ600SW, webOS 7.5.7-25, firmware 04.54.40), the underlying architectural flaws likely affect a broader range of webOS deployments.
Vulnerability Details
| Attribute | Detail |
|---|---|
| CVE Identifiers | None assigned |
| Severity | Critical (pre-auth root RCE from local network) |
| Affected Products | LG Smart TVs running webOS 7.5.7-25, firmware 04.54.40 (tested); other versions unknown |
| Vendor | LG Electronics |
| Patch Status | Firmware update available from LG |
| Active Exploitation | None reported in the wild |
| Attack Surface | Local network, port 3001 (LG ThinQ pairing service) |
Why This Matters Beyond the Living Room
The reflexive response is to dismiss smart TV vulnerabilities as consumer-grade trivia. That's a mistake. LG webOS devices are deployed across hospitality (hotel rooms), healthcare (patient room displays), corporate conference rooms, and digital signage networks — all environments where a compromised TV becomes a beachhead on a trusted internal segment. A device running as root that an attacker can fully control without credentials is not a peripheral concern; it's an insider threat node.
The exploit chain is a textbook study in layered trust failure: a test certificate trusted in production firmware, a pairing service that skips PIN validation under specific manifest permissions, a WebView component (cmp-client) that doesn't validate navigation targets, and a root-level logging daemon (pmlogd) that doesn't sanitize input. Each layer assumed the next would enforce boundaries. None did.
This pattern — trusting test/debug artifacts in shipping firmware, running network-facing services as root, and failing to validate input at privilege boundaries — is not unique to LG. It's a systemic IoT firmware problem we see repeatedly across smart device ecosystems. What makes this chain notable is its elegance: the attacker never needs to bypass a single control so much as abuse legitimate internal mechanisms that were never designed to be exposed.
Who Is at Risk
- Hospitality and healthcare: High-density LG TV deployments where guests or patients share the network with the devices.
- Corporate AV/conference rooms: Network-connected displays on internal LANs that may bridge to more sensitive segments.
- Digital signage operators: Large fleets of webOS displays, often remotely managed but locally accessible.
- Residential users: Anyone who hasn't applied the firmware update, particularly in shared or multi-tenant network environments.
Shield53 Recommendations
Immediate Actions
Strategic Guidance
Enterprises should treat consumer IoT devices with the same scrutiny as any other endpoint on the network. That means firmware inventory, network segmentation, and lifecycle management — including retirement of devices that can no longer receive security updates. The recurring nature of webOS vulnerabilities (Bitdefender's 2024 disclosures, TyphoonPWN 2025's path traversal, and now this chain) signals that LG's platform security model needs sustained third-party scrutiny, not periodic patching alone.
The absence of CVE identifiers here is itself a problem. Organizations that rely on CVE-based vulnerability management workflows will not see this issue in their scanners. Until identifiers are assigned, defenders must track this manually through vendor advisories and SSD Secure Disclosure's bulletin.
