LG webOS Flaws Allow Remote Root Command Execution Without Authentication
Four vulnerabilities in LG webOS versions 4-7 enable remote attackers to bypass authentication and execute commands as root, potentially impacting over 91,000 exposed TVs.
Security researchers have disclosed four critical vulnerabilities in LG webOS smart TVs, identified as CVE-2023-6317 through CVE-2023-6320, which could allow remote attackers to bypass authentication, create a privileged account, and execute commands with root-level access. These flaws affect selected LG TV models running webOS versions 4 through 7. Bitdefender researchers demonstrated that these vulnerabilities could grant an attacker full control over a vulnerable television if it is accessible on the same local network.
The potential reach of these vulnerabilities is significant, as researchers discovered over 91,000 LG TVs exposed to the internet via Shodan, an internet-connected device search engine. This exposure means that a local network weakness could be exploited by external attackers. LG has since released patches to address these issues, with Bitdefender publicly releasing their research in April 2024.
The most critical flaw, CVE-2023-6317, targets the pairing process used by the LG ThinQ mobile application. Typically, users must enter a PIN displayed on the TV to authorize the app. However, a weakness in the webOS account-registration process allows attackers to circumvent this PIN verification. By manipulating client-key and companion-client-key values, an attacker can request a low-permission account, capture its client key, and then reuse it to request a higher-permission account. The TV verifies the key's existence but fails to properly associate it with the new account request, thereby bypassing the on-screen PIN prompt.
Once an attacker successfully creates a privileged account, they can exploit other vulnerabilities to gain deeper access. CVE-2023-6318 and CVE-2023-6319 are command-injection vulnerabilities that enable the execution of operating system commands. Furthermore, CVE-2023-6320 affects a network configuration endpoint, allowing commands to be executed under the dbus account, which possesses permissions nearly equivalent to root.
Bitdefender confirmed the vulnerabilities across several webOS versions, including 4.9.7, 5.5.0, 6.3.3-442, and 7.3.1-43, on various LG TV models such as LG43UM7000PLA, OLED55CXPUA, OLED48C1PUB, and OLED55A23LA. The full exploit chain is particularly concerning as it combines a straightforward authentication bypass with the ability to execute arbitrary commands, all without requiring user interaction or PIN entry.
Successful exploitation could allow threat actors to alter TV settings, install unauthorized software, access connected services, or use the compromised TV as an entry point to pivot deeper into a victim's home network. LG's Product Security Response Center provides security bulletins for product issues, and the company commits to providing software and security updates for smart TVs for at least two years after launch, with the webOS platform itself receiving updates for five years from its launch date.
LG advises users to enable automatic software updates and manually check for firmware updates through the TV's settings menu. Additional security recommendations include avoiding direct internet exposure of smart TVs through router port forwarding, keeping home routers patched, and segmenting IoT devices onto a separate guest or IoT network. These measures help reduce the risk of external attackers reaching vulnerable devices and limit their ability to move laterally within a network.