LG Smart TVs Vulnerable to Pre-Auth Root Takeover From Local Network

Summary: Three vulnerabilities in LG's webOS can be chained to give an attacker on the same local network root access to certain smart TVs without a PIN or owner interaction, tested on the 32LQ636BPSA and 27TQ600SW running webOS 7.5.7-25 on firmware 04.54.40. The chain enters through the pairing service on port 3001, replays a manifest from the built-in sync-demo app signed with a trusted test certificate to obtain a privileged key, then uses the built-in cmp-client app to reach PalmServiceBridge and pass shell commands through pmlogd, which runs as root.
Why it matters: The exploit needs no PIN and no user action, only a foothold on the same local network, and no workaround exists for TVs that cannot be updated. This is the second disclosed webOS root chain from the local network since Bitdefender's 2024 findings, and no CVE identifiers have been assigned.

Read the original at The Hacker News ↗