Full Report
Three vulnerabilities in LG's webOS can be chained to give an attacker on the same local network root access to certain smart TVs without a PIN or any interaction from the owner. LG has issued a fix, according to an advisory published by SSD Secure Disclosure on October 12. The chain was tested on two TV models, the 32LQ636BPSA and the 27TQ600SW, running webOS 7.5.7-25 on firmware
Analysis Summary
# Vulnerability: LG webOS Local Pre-Auth Root Chain
## CVE Details
- **CVE ID:** None assigned (as of October 2026)
- **CVSS Score:** N/A (Not officially scored, but involves unauthenticated remote root access, suggesting a **Critical** rating)
- **CWE:**
- CWE-287: Improper Authentication
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
- CWE-94: Improper Control of Generation of Code ('Code Injection')
## Affected Systems
- **Products:** LG Smart TVs
- **Versions:** webOS 7.5.7-25 (Firmware version 04.54.40)
- **Configurations:** Devices with port 3001 exposed to the local network (typically used for LG ThinQ app pairing).
- **Tested Models:** 32LQ636BPSA and 27TQ600SW. Other models running the same firmware may be affected.
## Vulnerability Description
This vulnerability involves a three-step exploit chain:
1. **Authentication Bypass:** The pairing service on port 3001 trusts a test certificate used to sign the manifest of a built-in app (`sync-demo`). An attacker can replay this manifest to trick the TV into skipping the PIN prompt and issuing a privileged access key.
2. **Arbitrary Page Navigation:** Using the stolen key, the attacker launches another built-in app (`cmp-client`) and forces it to navigate to a malicious external URL. This app fails to validate the destination and provides the loaded page with access to the `PalmServiceBridge` internal interface.
3. **Command Injection:** Through the bridge, the attacker interacts with the system logging service (`pmlogd`). The service fails to sanitize input fields, allowing the attacker to inject shell commands. Because `pmlogd` runs with root privileges, the commands execute with full system authority.
## Exploitation
- **Status:** PoC available (demonstrated at TyphoonPWN 2026); no reported exploitation in the wild.
- **Complexity:** Medium (requires chaining three specific flaws).
- **Attack Vector:** Adjacent (Attacker must be on the same local network as the TV).
## Impact
- **Confidentiality:** High (Full access to TV data and services)
- **Integrity:** High (Full system control/root access)
- **Availability:** High (Ability to disable or brick the device)
## Remediation
### Patches
- LG has issued a fix according to the SSD Secure Disclosure advisory published on October 12, 2026. Users should check for and install the latest firmware updates via the TV's settings menu.
### Workarounds
- **None:** No official workarounds are available for users unable to update.
- **General Mitigation:** Isolate IoT devices on a separate VLAN to prevent untrusted local network devices from accessing port 3001.
## Detection
- **Indicators of Compromise:** Unexpected outbound connections from the TV to unknown external IPs (via `cmp-client`); unusual logs originating from the `pmlogd` service.
- **Detection methods and tools:** Network scanning to identify TVs exposing port 3001; monitoring for unauthorized pairing requests.
## References
- **Vendor Advisory:** hxxps[://]ssd-disclosure[.]com/lg-webos-sync-demo-preauth-rce/
- **Historical Context:** hxxps[://]thehackernews[.]com/2024/04/researchers-discover-lg-smart-tv[.]html
- **Research Source:** TyphoonPWN 2026 Competition Results.