Three webOS flaws chain into local-network root takeover of LG TVs

An anonymous researcher has demonstrated a chain of three vulnerabilities in webOS, the operating system that powers LG televisions. Linked together, they let an attacker on the same local network gain full root access to the device — without entering a PIN and without any interaction from the owner. The finding was published on October 12 by SSD Secure Disclosure, and LG has already issued a fix.

The chain was tested on two models — the 32LQ636BPSA and the 27TQ600SW — running webOS 7.5.7-25 on firmware 04.54.40. Whether other models or firmware versions are affected is not known. Owners should check for an update; there is no workaround for those who cannot yet patch.

How the attack works

The way in is a service the TV exposes on port 3001, used by the LG ThinQ app for pairing. The attacker replays a manifest from sync-demo — a built-in app already present on the device — signed with a test certificate the firmware trusts. A permission in that manifest makes the pairing service skip the PIN prompt and hand over a privileged key.

With that key, the attacker launches another built-in app, cmp-client, and points it at an attacker-controlled page. The app never checks where it navigates, and the loaded page retains access to PalmServiceBridge, an internal interface to the TV's system services.

Through that bridge, the attacker reaches the system logging service, pmlogd, passing shell commands through an input field the service does not validate. Because pmlogd runs as root, the injected command runs as root.

Not the first time

The local-network attack surface has led to root on LG TVs before. In 2024, Bitdefender disclosed a different set of webOS flaws that also allowed unauthenticated network access; they affected other components and were patched in March 2024. A separate chain shown at TyphoonPWN 2025 relied on a path traversal on a different port.

The current chain was demonstrated at TyphoonPWN 2026 in Seoul in May, where its author took third place in the LG webOS category. No CVE identifiers have been assigned, and no exploitation in the wild has been reported.

Source: The Hacker News