Skip to content
Today
Sign in

SecurityNot yet confirmed elsewhere1 publisher2 min readPublished

Chained webOS flaws hand root on certain LG TVs to anyone on the same network

Three chained webOS flaws give a same-network attacker root on certain LG smart TVs without a PIN, according to an SSD Secure Disclosure advisory. LG has issued a fix, but only two models were tested.

The Watch · Security desk

How we use AISend a correction

Advisory came about five months after the contest Dates of a different set of webOS flaws being patched, this chain's demonstration at TyphoonPWN 2026, and the advisory dated October 12.

Timeline of three dates: in March 2024 a different set of webOS flaws disclosed by Bitdefender was patched; in May 2026 this chain was demonstrated at TyphoonPWN 2026 in Seoul, taking third place; on October 12 an advisory was dated, about five months after the May 2026 contest.

  1. 2024Different set of webOS flaws, disclosed by Bitdefender, patched, claim 11
  2. 2026Chain demonstrated at TyphoonPWN 2026 in Seoul, third place, claim 13
  3. 2026Advisory dated October 12, about five months after the contest, claim 16
Advisory came about five months after the contest
DateEventClaim
March 2024Different set of webOS flaws, disclosed by Bitdefender, patched11
May 2026Chain demonstrated at TyphoonPWN 2026 in Seoul, third place13
October 12, 2026Advisory dated October 12, about five months after the contest16

What happened

  • The attack enters through a service on port 3001 that the LG ThinQ app uses for pairing.
  • A permission in the replayed manifest lets the attacker bypass the PIN step, and the pairing service issues a privileged key.
  • Holding that key, the attacker opens the built-in cmp-client app on a page of their own. That page keeps access to PalmServiceBridge, an internal interface to the TV's system services.
  • An anonymous researcher demonstrated the chain at TyphoonPWN 2026 in Seoul in May, taking third place in the contest's LG webOS category.
  • The flaws carry no CVE identifiers, and nobody has reported exploitation in the wild.

Why it matters

  • exposure Two sets on one firmware version are confirmed exposed. Any other LG webOS TV has not been checked either way.
  • constraint Until a set takes the update, nothing on the device closes the path. In our view the only lever left to an operator is who shares the network with it.
  • decision With no CVE assigned, a fleet owner has no identifier to search on and has to match model and firmware strings by hand.

The chain starts and ends on trust errors. At the front, the attacker replays a manifest from the built-in sync-demo app, signed with a test certificate that the firmware trusts [7]. At the back, the attacker calls the pmlogd logging service through PalmServiceBridge and passes shell commands through an input field it does not check [10]. pmlogd runs as root, so the injected command runs as root [10].

Effort is low. No stage needs a credential, and the owner is never prompted [1]. The limit is reach: the attacker has to be on the same local network as the TV [1].

The advisory is dated October 12 [2], about five months after the May contest [16]. The write-up names the port, the apps and the service involved [c6, c7, c10].

This is the third public webOS local-network finding in the source's account [15]. Bitdefender disclosed a different set in 2024 that also allowed unauthenticated access from the network, affected different components, and was patched in March 2024 [11]. A chain shown at TyphoonPWN 2025 used a path traversal on a different port [12]. Neither earlier case entered the way this one does. In our view the pattern is a sustained research target, and a patch for one chain says nothing about the next.

Owners of affected TVs should check for a firmware update, and no workaround exists for sets that cannot take one [5]. The two sets tested were the 32LQ636BPSA and the 27TQ600SW, both on webOS 7.5.7-25 with firmware 04.54.40 [3]. Exposure on other models or firmware builds is unknown [4].

What to watch

  • A CVE assignment, or an LG notice listing the affected models and firmware versions beyond the two tested.
  • Publication of exploit code for the port 3001 chain, or the first report of exploitation in the wild.
  • Any further webOS local-network chain from TyphoonPWN entrants or other researchers.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence60
Adoption
Insufficient
Hype gap−5
Incentives
Insufficient
Confidence58
Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

  1. [1]

    Three vulnerabilities in LG's webOS can be chained to give an attacker on the same local network root access to certain smart TVs without a PIN or any interaction from the owner.

    ReportedSupportedSource: The Hacker News report on the SSD Secure Disclosure advisoryView cited source
  2. [2]

    LG has issued a fix, according to an advisory published by SSD Secure Disclosure on October 12.

    ReportedSupportedSource: SSD Secure Disclosure advisory, as reported by The Hacker NewsView cited source
  3. [3]

    The chain was tested on two TV models, the 32LQ636BPSA and the 27TQ600SW, running webOS 7.5.7-25 on firmware 04.54.40.

    ReportedSupportedView cited source

Sources

1 independent publisher whose own reporting we read for this story.

  1. thehackernews.com

    1 article · October 13, 2026

    LG Smart TVs Vulnerable to Pre-Auth Root Takeover From Local Network

Share your take

Let Clarity write the post for you.

Signed-in readers get a short post drafted on this story in the register they choose — narrative, analytical, or a direct position — editable to the last word before it goes anywhere. The share buttons at the top of this story work without an account.

Create a free account to composeSign in

Topics and entities

Follow any of these and your For You feed starts watching them — no settings page required.

Topics

Entities

Loading related stories