Three webOS vulnerabilities can be chained to achieve unauthenticated root access on certain LG smart TVs via the local network.
The attack leverages port 3001 pairing mechanisms, test certificates, and unchecked shell commands passed to pmlogd.
LG has issued a firmware patch.
The company has already released an update that fixes the problem, according to an announcement published on October 12, 2026. The issue was tested on the 32LQ636BPSA and 27TQ600SW models with webOS software version 7.5.7-25 and firmware 04.54.40, however it is not known if other models are affected.
Owners of affected TVs are urged to check for available software updates, as there is no other solution.
How was the attack carried out?
The attack exploited a port on the TV used by an app to connect devices. By sending appropriate data, an attacker could bypass the password check and gain privileged access.
It was then able to execute internal TV applications and pass system commands through a service that did not properly check the data it received. Because this service was running with maximum privileges, the commands were executed without restrictions.
The issue was reported by an anonymous researcher who won third place in the webOS category at a security competition in Seoul last May. No actual attacks of this kind have been reported so far.
Top comments (0)