Three LG webOS Flaws Enable Pre-Authentication Root Access to Smart TVs on Local Networks

Summary

A three-flaw chain can give attackers on the same local network root access to certain LG webOS TVs without a PIN or owner interaction. LG has issued a fix; affected models and firmware beyond those tested are unknown.

Key points

The chain was tested on LG 32LQ636BPSA and 27TQ600SW TVs running webOS 7.5.7-25, firmware 04.54.40; the broader scope is unknown.
The attack starts at the TV's pairing service on port 3001, using a built-in app manifest and trusted test certificate to bypass the PIN prompt and obtain a privileged key.
The attacker uses the key to launch cmp-client and load an attacker-controlled page that retains access to PalmServiceBridge.
Through PalmServiceBridge, commands are passed to pmlogd, which runs as root and does not check the relevant input.
LG has issued a fix. Owners should check for a firmware update; no workaround is available for devices that cannot yet be updated.
The chain was demonstrated by an anonymous researcher at TyphoonPWN 2026. No CVE identifiers have been assigned, and no in-the-wild exploitation has been reported.

Article Details

Vulnerability Types: Authentication bypass
Command injection
Privilege escalation
Affected Versions: webOS 7.5.7-25
firmware 04.54.40
Exploitation Status: not_reported
Exploit Availability: unknown
Patch Status: available

MITRE ATT&CK

T1059.004 · Unix ShellThe attacker passes shell commands through an unchecked input field to pmlogd, which runs them as root.

Vendors

LGThree vulnerabilities in LG's webOS can be chained to give an attacker on the same local network root access to certain smart TVs without a PIN or any interaction from the owner.

Products

27TQ600SWThe chain was tested on two TV models, the 32LQ636BPSA and the 27TQ600SW, running webOS 7.5.7-25 on firmware 04.54.40. Whether other models or firmware versions are affected is not known.32LQ636BPSAThe chain was tested on two TV models, the 32LQ636BPSA and the 27TQ600SW, running webOS 7.5.7-25 on firmware 04.54.40. Whether other models or firmware versions are affected is not known.LG ThinQThe attack enters through a service that the TV exposes on port 3001, which is used by the LG ThinQ app for pairing. An attacker replays a manifest from sync-demo, a built-in app already on the device, signed with a webOSThree vulnerabilities in LG's webOS can be chained to give an attacker on the same local network root access to certain smart TVs without a PIN or any interaction from the owner.