LG Smart TV vulnerability enables local root takeover
An LG Smart TV vulnerability chain in webOS can allow an attacker on the same local network to gain root access to certain televisions without a PIN and without any action from the owner, according to an advisory published by SSD Secure Disclosure on October 12.
LG has issued a fix, the advisory states. The reported chain was tested on two models, the 32LQ636BPSA and the 27TQ600SW, both running webOS 7.5.7-25 on firmware 04.54.40. SSD Secure Disclosure says it is not known whether other models or firmware versions are affected. Owners of affected TVs should check for a firmware update. The advisory does not list a workaround for owners who cannot update yet.
The issue matters because the attack does not start with a malicious website, a phishing message or physical access to the television. It starts from the local network, meaning the attacker must already be connected to the same home, office or guest network as the TV. In practical terms, that makes network separation and device updates important for businesses that place smart displays, TVs or signage devices on the same networks as workstations, phones or other internal systems.
The first step in the chain reaches a service exposed by the television on port 3001. A port is a numbered network doorway used by software to receive connections. In this case, the service is used by the LG ThinQ app for pairing, the process that links an app to the TV. SSD Secure Disclosure says the attacker can replay a manifest from sync-demo, a built-in app already present on the device. A manifest is a file that describes what an app is and what permissions it requests. The replayed manifest is signed with a test certificate that the firmware trusts.
That manifest includes a permission that causes the pairing service to skip the PIN prompt. As a result, the attacker can obtain a privileged key without the owner typing a PIN or approving anything on the TV. In this context, a privileged key is a credential that lets the attacker access functions that should be restricted.
The chain then uses that key to launch another built-in app, cmp-client. SSD Secure Disclosure says the attacker can direct cmp-client to a web page controlled by the attacker. The app does not verify where it is being sent, and the page it loads keeps access to PalmServiceBridge, an internal interface that can talk to system services on the TV.
Through PalmServiceBridge, the attacker can call pmlogd, the system logging service. A logging service is software that records system messages and events. SSD Secure Disclosure says pmlogd accepts shell commands through an input field that is not properly checked. A shell command is an instruction sent to the operating system. Because pmlogd runs as root, those injected commands also run as root. Root is the highest level of control on a Unix-like system, and root access means the attacker can issue commands with full system privileges.
No CVE identifiers have been assigned to the three vulnerabilities described in the chain. SSD Secure Disclosure also says no exploitation in the wild has been reported. That distinction is important: the advisory describes a working attack path demonstrated by a researcher, but it does not say that attackers are currently using it against owners.
The chain was demonstrated by an anonymous researcher who won third place in the LG webOS category at TyphoonPWN 2026, held in Seoul in May. The advisory also places the finding in a broader pattern of local network attack surface on smart TVs. In 2024, Bitdefender disclosed a different set of webOS vulnerabilities that allowed unauthenticated network access, affected different components and were patched in March 2024. A separate chain demonstrated at TyphoonPWN 2025 used a path traversal on a different port.
For site owners and IT teams, the lesson is not that a television is the same as a web server. It is that smart devices often expose services on internal networks, and those services can become entry points if devices are left unpatched or placed on networks with more sensitive systems. Offices, shops, schools and hospitality venues often use smart TVs as meeting-room screens or digital displays, and those devices may sit quietly on the same network for years unless someone is responsible for updates.
Owners should start by checking the TV’s update settings and installing any available firmware update for affected models. If a business cannot update immediately, the advisory does not provide a software workaround, so the safer operational step is to reduce exposure by keeping the TV off sensitive networks where possible and limiting who can join the same local network. Guest Wi-Fi, display networks and staff networks should not be treated as interchangeable simply because they are in the same building.
For organisations reviewing where smart displays and other connected devices sit in their environment, AEU-I provides security-first IT, infrastructure and consulting, which is relevant when separating everyday devices from systems that carry business risk.
Until more affected-model information is available, the clearest action is to update affected TVs and avoid giving untrusted users access to the same local network. The advisory does not say that every LG webOS TV is affected, and it does not provide evidence of active attacks, but it does show how a local service intended for app pairing can become a path to full device control when multiple flaws are chained together.