Researchers have disclosed a chain of three vulnerabilities in LG's webOS that can give an attacker on the same local network root access to certain smart TVs without requiring a PIN or any interaction from the owner. The issue was reported by SSD Secure Disclosure on October 12, and LG has issued a fix. The chain was tested on the 32LQ636BPSA and 27TQ600SW models running webOS 7.5.7-25 on firmware 04.54.40; whether other models are affected is unknown.
According to the advisory, the attack enters through a pairing service exposed on port 3001, used by the LG ThinQ app. The attacker replays a manifest from the built-in sync-demo app, signed with a test certificate the firmware trusts. A permission in that manifest makes the pairing service skip the PIN prompt and hand over a privileged key. The attacker then launches the built-in cmp-client app and points it to a malicious page, which retains access to PalmServiceBridge, an internal interface to system services. Through that bridge, the attacker sends shell commands to the pmlogd logging service, which runs as root and does not validate the input, resulting in root command execution.
This is not the first time LG's local network attack surface has led to root access. In 2024, Bitdefender disclosed a different set of webOS vulnerabilities that also allowed unauthenticated network access and were patched in March 2024. Another chain demonstrated at TyphoonPWN 2025 used a path traversal on a different port. The current chain was demonstrated by an anonymous researcher who placed third in the LG webOS category at TyphoonPWN 2026 in Seoul. No CVE identifiers have been assigned, and no exploitation in the wild has been reported. Owners of affected TVs should check for a firmware update; no workaround is available.