Researchers have published a working exploit chain that gives an attacker on the same local network unauthenticated root command execution on certain LG smart TVs. The SSD Secure Disclosure advisory, published October 12, describes a three-stage attack against LG webOS and says LG has issued a fix, although the vendor’s bulletin does not specify fixed firmware versions in the published research.
The chain was demonstrated on the LG 32LQ636BPSA and 27TQ600SW, running webOS 7.5.7-25 and firmware 04.54.40. SSD did not establish that every LG television or webOS release is affected, so the tested configuration should not be treated as a complete product-scope list. Owners should check their model’s software-update screen and LG’s TV security bulletin for applicable remediation.
The attack reaches a WebSocket service exposed on port 3001 for ThinQ pairing. It replays a signed manifest from the built-in sync-demo application, abusing the trusted STB_INTERNAL_CONNECTION permission to obtain a privileged client key without displaying the normal PIN prompt. The attacker then launches the trusted cmp-client application with an attacker-controlled interactiveUrl. SSD says the application lacks adequate scheme, host and origin checks, allowing the remote page to retain access to webOS’s PalmServiceBridge interface.
The final stage abuses the collectAllLog method in the pmlogd service. SSD reports that attacker-controlled targetDir and targetFile values are incorporated into shell commands without sufficient validation. Because the logging daemon runs as root, commands injected through those fields execute with root privileges. The advisory includes a complete Python proof of concept and says successful execution can be confirmed by producing a file containing uid=0(root).
The disclosure does not assign CVE identifiers or provide CVSS v3 or v4 scores. No corresponding NVD record was identified for this newly published chain, and SSD’s advisory reports no exploitation in the wild or threat-actor attribution. The public PoC nevertheless lowers the barrier to testing and makes unpatched televisions more attractive targets for attackers who can join the same wireless or wired network.
LG TV owners should install the latest firmware offered for their specific model and avoid placing affected televisions on untrusted or shared networks until updates are applied. Network segmentation can reduce exposure, but it is not a substitute for patching: the attack requires local network reachability rather than owner interaction, and SSD reports no workaround for systems that cannot yet be updated.
