Science & Tech · Cybersecurity · 2 hrs ago
LG Fixes WebOS Flaw That Could Give Local Network Attackers Root Access
Three webOS vulnerabilities could give attackers full control of some LG TVs without a PIN or action from the owner.
The attack requires the attacker to be on the same local network as the TV.
Researchers tested the chain on two LG models running webOS 7.5.7-25, but it is not known which other models or versions are affected.
The flaws let an attacker misuse built-in TV apps and services to run commands with root access, which gives broad control of the device.
LG has issued a fix, and owners of affected TVs should check for a firmware update.
There is no workaround for owners who cannot update yet.
No exploitation in the wild has been reported, and the flaws have no assigned CVE identifiers.
Three vulnerabilities in LG webOS can be chained to give an attacker on the same local network root access to certain smart TVs without a PIN or owner interaction.
LG has issued a fix, according to an advisory published by SSD Secure Disclosure on October 12.
The attack was tested on two TV models running webOS 7.5.7-25 on firmware 04.54.40.
It is not known whether other models or firmware versions are affected, and no exploitation in the wild has been reported.
- Who
- An attacker on the same local network; the vulnerability chain was demonstrated by an anonymous researcher.
- What
- Three webOS vulnerabilities can be chained to gain root access to certain LG smart TVs without a PIN or owner interaction.
- When
- LG’s fix was reported in an advisory published on October 12. The year is not stated in the advisory description.
- Where
- Certain LG smart TVs on a local network.
- Why
- Not stated
This story does not have two clearly opposing sides.
An anonymous researcher demonstrated the chain at TyphoonPWN 2026 in Seoul and won third place in the LG webOS category.
SSD Secure Disclosure published an advisory reporting that LG had issued a fix.
The Hacker News published its report on the vulnerability chain.
- Vulnerability chain
- Three webOS vulnerabilities
- Tested models
- 32LQ636BPSA and 27TQ600SW
- Tested software
- webOS 7.5.7-25; firmware 04.54.40
- Attack entry point
- Port 3001, used by the LG ThinQ app for pairing
- Fix advisory
- Published October 12
- Known exploitation
- No exploitation in the wild reported
Sources
Related news
Ahold Delhaize takes some systems offline after cyberattack
Cyberattack overheats refrigeration systems in hundreds of French supermarkets
Cyberattack Defrosts Refrigerators at Hundreds of French Supermarkets
Cyberattack disrupts systems at TFG’s three UK fashion brands
GitLab urges self-managed users to patch critical code execution flaw
Ridge Security launches on-site AI penetration testing system
French supermarket hack raises concerns about smart home devices
Hackers take control of cooling units at 350 French supermarkets
Canadian cybersecurity executive arrested on federal extortion charges
