LG webOS Flaws Let Attackers Take Root on Smart TVs From Your Local Network

On October 12, a security advisory published by SSD Secure Disclosure described a chain of three vulnerabilities in LG's webOS that can give an attacker root access to certain smart TVs. No PIN, no pairing approval, no click from the owner. All the attacker needs is a foothold on the same local network as the television, and the chain does the rest, ending with arbitrary commands running as root on the most networked screen in the house.

The disclosure lands at an awkward moment for the smart home. Televisions are no longer dumb panels. They run full operating systems, stay online around the clock, pair with phones through companion apps, and sit at the center of the home network with a trusted view of every other device. A root shell on the living room TV is not just a TV problem. It is a beachhead inside the house.

How three small flaws became full root access

The chain begins with something mundane: the pairing service LG's ThinQ app uses to connect a phone to the TV, listening on TCP port 3001. According to the SSD advisory, an attacker replays an app manifest embedded in a built-in application called sync-demo, which is signed with a test certificate that the firmware treats as trusted. The manifest carries a permission, STB_INTERNAL_CONNECTION, that sends the pairing service down its prompt-skip path, issuing a privileged client key without ever showing the PIN prompt.

With that key in hand, the attacker launches a second preinstalled app, cmp-client, and points it at a page under attacker control through its interactiveUrl parameter. The app does not check where it navigates, so the loaded page retains access to PalmServiceBridge, an internal interface that connects applications to webOS system services. That bridge becomes the escalator to the final flaw.

The last link is a command injection in pmlogd, the system logging daemon, in its collectAllLog method. The method builds shell commands from caller-controlled values, including the targetDir parameter, without sanitizing them. Shell metacharacters in that parameter execute, and because the PmLogDaemon runs as root, the injected commands run as root. The advisory summarizes the full chain as a sync-demo manifest replay that bypasses client-key issuance, an SSRF-style navigation through cmp-client, and a command injection in pmlogd, each unremarkable alone and devastating together.

Two models confirmed, the rest of the map is blank

The researcher demonstrated the chain against two specific models, the LG 32LQ636BPSA and the LG 27TQ600SW, both running webOS 7.5.7-25 on firmware 04.54.40. Whether other models or firmware versions share the flaws is not known. That uncertainty is the honest boundary of the evidence: two models are confirmed, a software design that could appear elsewhere is suspected, and the exact list of affected devices is not public.

There are more gaps. No CVE identifiers have been assigned to the three flaws, which makes them harder to track in the standard vulnerability databases that many IT teams and patch management tools rely on. LG has issued a fix, published through its security bulletins, but the advisory does not detail the corrected firmware versions per model. The practical advice from the disclosure is blunt: owners of affected TVs should check for a firmware update, and there is no workaround for anyone who cannot update yet.

The TV is the only computer most people never patch, never monitor, and never think of as a computer at all, which makes it the ideal place to hide.

This is webOS's third local-network root scare

The pattern will look familiar to anyone who has followed smart TV security. In 2024, Bitdefender disclosed a different set of webOS vulnerabilities, tracked as CVE-2023-6317 through CVE-2023-6320, that also allowed unauthenticated access from the local network across webOS versions 4 through 7, affecting several TV models. LG patched those in March 2024. A separate chain demonstrated at the TyphoonPWN security competition in 2025 used a path traversal on a different port. The 2026 chain uses a completely different route, but the entry point is the same: services the TV exposes to the local network, built to make setup easy and left trusting everything on the wire.

The new chain was demonstrated by an anonymous researcher who took third place in the LG webOS category at TyphoonPWN 2026, held in Seoul in May. SSD Secure Disclosure published the technical account on October 12. As of the disclosure, no exploitation in the wild has been reported, which is genuinely good news. The chain requires local network access, which is a meaningful hurdle for a random attacker. It is worth being precise about what that hurdle is, though, because it is lower than many households assume. Local access can mean a person already on the Wi-Fi, malware on another device in the house that reaches across the network, an untrusted guest handed the Wi-Fi password, or a misconfigured router exposing local services further than intended.

What to do this week

If you own an LG smart TV, the first step is the boring one: open Settings, find the software update section, and install whatever is available. That single habit is the entire defense for a device that cannot be watched the way a laptop can. The confirmed vulnerable models are the 32LQ636BPSA and the 27TQ600SW on webOS 7.5.7-25 and firmware 04.54.40, but because the full scope of affected models is unknown, updating any LG TV is the safer bet. If your set cannot be updated to a fixed firmware, there is no published workaround, so the device needs extra attention rather than less of it.

The second step is to give your TV its own boundary. Put smart home devices, TVs, and anything you would not log into your bank from on a separate network segment or guest network, so a compromise of one device does not hand over everything else for free. Treat the Wi-Fi password with the seriousness it deserves: anyone on the network is, as this disclosure shows, one clever chain away from root on the television. Finally, make sure the TV is not reachable from outside the house. The local-network requirement is the main thing standing between this chain and your front door, and it is worth keeping that door closed on purpose.

Step back, and the throughline of this story is that the smart home's softest target keeps being the screen in the living room. Phones get patched monthly and laptops run endpoint software, but the television, the device with a camera in some models, a microphone in many, and a permanent trusted spot on the home network, gets updated when someone remembers and secured never. The 2026 chain does not require an exotic nation-state toolkit. It replays a test manifest, points a built-in app at a bad page, and injects a shell command into a logging service. When the whole attack can be assembled from the TV's own components, the lesson is that the home network is a trust boundary, and it deserves to be defended like one.