● Covered by 1 source · 1 reportMedium impact1 neutral
LG Smart TVs Vulnerable to Local Network Root Takeover via webOS Vulnerabilities
Key points
- Three webOS vulnerabilities allow local network root access.
- Attack chain bypasses PIN and user interaction.
- LG issued a fix for affected TV models.
- No in-the-wild exploitation reported.
Vulnerabilities Discovered
Three vulnerabilities in LG's webOS operating system can be combined to grant an attacker root access to specific LG smart TVs. The attack requires the attacker to be on the same local network as the television. No PIN or user interaction is needed for the exploit to succeed.
Affected Models and Fix
The vulnerability chain was successfully tested on LG TV models 32LQ636BPSA and 27TQ600SW, running webOS 7.5.7-25 with firmware 04.54.40. It is currently unknown if other models or firmware versions are also affected. LG has released a firmware update to address these issues, as reported by SSD Secure Disclosure on October 12. Owners of potentially affected TVs should check for and install available firmware updates.
Attack Mechanism
The attack begins by exploiting a service on port 3001, used by the LG ThinQ app for pairing. An attacker replays a manifest from a built-in app, signed with a trusted test certificate, which causes the pairing service to bypass the PIN prompt and provide a privileged key. This key is then used to launch another built-in app, 'cmp-client', redirecting it to an attacker-controlled webpage. This page maintains access to PalmServiceBridge, an internal interface to the TV's system services. Through PalmServiceBridge, the attacker calls the 'pmlogd' system logging service, injecting shell commands via an unchecked input field. Since 'pmlogd' runs as root, the injected commands execute with root privileges.
Prior Incidents
This is not the first instance of local network attacks leading to root access on LG smart TVs. In 2024, Bitdefender disclosed a different set of webOS vulnerabilities that also permitted unauthenticated network access, affecting different components, and were patched in March 2024. Another separate vulnerability chain, demonstrated at TyphoonPWN 2025, utilized a path traversal on a different port.
Disclosure and Impact
The current vulnerability chain was demonstrated by an anonymous researcher who secured third place in the LG webOS category at TyphoonPWN 2026 in Seoul. No CVE identifiers have been assigned for these vulnerabilities, and there have been no reports of active exploitation in the wild.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Reporting from
Three vulnerabilities in LG's webOS can be chained to allow an attacker on the same local network to gain root access to certain smart TVs without authentication. LG has released a fix for these vulnerabilities, which were demonstrated at TyphoonPWN 2026.