LG Smart TVs Vulnerable to Pre-Authentication Root Takeover From Local Network
Three chained vulnerabilities in LG's webOS allow unauthenticated attackers on a local network to gain root access to certain smart TVs without user interaction.
Security researchers have uncovered a critical vulnerability chain affecting LG's webOS smart TV platform, enabling attackers on the same local network to achieve pre-authentication root takeover. The flaws, detailed in an advisory by SSD Secure Disclosure, allow an attacker to bypass PIN prompts and gain complete control over the affected television.
The vulnerabilities were successfully tested on specific LG TV models, including the 32LQ636BPSA and 27TQ600SW, running webOS version 7.5.7-25 with firmware 04.54.40. While LG has since released a firmware update to address these issues, the full scope of affected models and firmware versions remains unknown. Owners of LG smart TVs are strongly advised to check for and install the latest firmware updates to protect their devices.
The attack vector begins by exploiting a service on port 3001, typically used by the LG ThinQ app for device pairing. An attacker can replay a manifest from a pre-installed application, signed with a test certificate that the TV's firmware implicitly trusts. This allows the attacker to trick the pairing service into skipping the usual PIN verification and granting a privileged key.
With this privileged key in hand, the attacker can then launch another built-in application, cmp-client, and direct it to a malicious webpage controlled by the attacker. Crucially, this application does not validate the source of the loaded page, maintaining access to PalmServiceBridge, an internal interface that provides access to the TV's core system services.
Through PalmServiceBridge, the attacker can interact with the system logging service, pmlogd. By injecting shell commands into an input field within pmlogd that lacks proper sanitization, the attacker can execute arbitrary commands with root privileges, as pmlogd itself runs with elevated permissions.
This is not the first time LG smart TVs have been found vulnerable to network-based attacks. In 2024, Bitdefender disclosed a separate set of webOS vulnerabilities that also permitted unauthenticated network access, albeit affecting different components and requiring different exploitation methods. A previous demonstration at TyphoonPWN 2025 also showcased a distinct exploit chain involving path traversal on a different port.
The researcher behind this latest discovery, who remained anonymous, presented their findings at TyphoonPWN 2026 in Seoul, securing third place in the LG webOS category. As of the advisory's publication, no specific CVE identifiers have been assigned to these chained vulnerabilities, and there have been no reports of exploitation in the wild. However, the potential for widespread compromise of LG smart TVs necessitates prompt patching by users.