Full Report
When WebOS has a USB thumb drive plugged into it, it opens a port on the TV. This allows peer devices to call the API /getFile?path=xxxxxx to get files from the mounted USB. The device doesn't have any filtering on the path for directory traversal vulnerabilities. By using a classic directory traversal, you can read arbitrary files from the system. This by itself is bad but what can we do with it? There's a database that contains peer authentication keys. By stealing these keys, it's possible to bypass authentication on the secondscreen service. With this, they can enable developer mode to install arbitrary apps and gain control of the device. The vulnerability is simple yet the impact derived from this is terrible. Good find! I was also surprised to find that the PoC includes a Docker image for the TV, making it easy to run.
Analysis Summary
# Vulnerability: LG WebOS Path Traversal and Authentication Bypass
## CVE Details
- **CVE ID:** Pending (Associated with Vendor Advisory SMR-SEP-2025)
- **CVSS Score:** Not specified (Estimated High/Critical due to Remote Code Execution/Full Takeover)
- **CWE:** CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
## Affected Systems
- **Products:** LG WebOS TV
- **Versions:** LG WebOS 43UT8050 (and likely other models running similar WebOS versions)
- **Configurations:** A USB storage device must be physically plugged into the TV to trigger the vulnerable service.
## Vulnerability Description
When a USB thumb drive is connected to the LG TV, the `browser-service` automatically opens a web server on port **18888**. This service exposes an API endpoint `/getFile?path=...` intended to allow peer devices to access files located in `/tmp/usb` or `/tmp/home.office.documentviewer`.
However, the application lacks input validation and filtering on the `path` parameter. By using classic directory traversal sequences (`../../`), an attacker can escape the intended directories and read arbitrary files from the system with the privileges of the service.
## Exploitation
- **Status:** PoC available. A Docker-based exploit chain exists that automates the file theft and subsequent takeover.
- **Complexity:** Medium (Requires a USB device to be plugged in and access to the local network).
- **Attack Vector:** Adjacent (Network-based, typically requiring the attacker to be on the same local network as the TV).
## Impact
- **Confidentiality:** **High** – Arbitrary system files, including sensitive databases and authentication keys, can be read.
- **Integrity:** **High** – By stealing authentication keys, attackers can bypass security on the `secondscreen.gateway` service to enable developer mode and install unauthorized applications.
- **Availability:** **High** – Full device takeover allows for persistent control and potential bricking or misuse of the device.
## Remediation
### Patches
- LG has released security advisory **SMR-SEP-2025**. Users should update their TV firmware to the latest version immediately via the system settings.
### Workarounds
- **Physical Security:** Disconnect USB storage devices when not in use, as this closes the vulnerable port (18888).
- **Network Isolation:** Place IoT devices like Smart TVs on a dedicated VLAN or guest network to prevent lateral movement from compromised peer devices.
## Detection
- **Indicators of Compromise:**
- Presence of unexpected port **18888** being open on the TV.
- Log entries or network traffic showing `GET` requests to `/getFile?path=` containing `..` sequences.
- Unauthorized applications appearing in the WebOS interface.
- **Detection Methods:** Port scanning (Nmap) and network traffic analysis for traversal patterns.
## References
- **Vendor Advisory:** hxxps[://]lgsecurity[.]lge[.]com/bulletins/tv
- **SSD Secure Disclosure:** hxxps[://]ssd-disclosure[.]com/lg-webos-tv-path-traversal-authentication-bypass-and-full-device-takeover/