Researchers say a chain of vulnerabilities can bypass PIN protection and provide root-level access to certain LG televisions on the same network. LG has released a firmware fix.
Security researchers have identified a chain of three flaws in LG’s webOS that could let an attacker take full control of some of the company’s smart televisions, provided the device is on the same local network. According to findings reported by SSD Secure Disclosure and covered by The Hacker News, the weaknesses can be linked together to obtain root-level privileges, giving an intruder the highest level of access on the television’s operating system.
The issue was demonstrated on LG’s 32LQ636BPSA and 27TQ600SW models, both running webOS 7.5.7-25 and firmware version 04.54.40. The reported attack path does not require the owner’s PIN or any interaction from the user, but it does depend on access to the same home or office network as the television. That local-network requirement narrows the attack surface, yet still leaves exposed devices vulnerable in environments where many connected products share the same Wi-Fi.
The flaws affect parts of the communication framework in webOS, including the pairing function used with the LG ThinQ mobile app. Security reporting on the issue says the weaknesses could be used to bypass PIN protection before escalating privileges and issuing system commands. No exploitation in the wild has been reported, and the material reviewed indicates that no CVE identifiers have been assigned so far. Similar concerns have been raised around webOS security before, including reports in 2024.
LG has already issued a firmware update to address the problem, and owners of affected televisions are being advised to check for updates in the settings menu and install the latest available version. For consumers, the practical message is simple: smart televisions are connected computers, and they need the same attention to software maintenance as phones, routers and laptops.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
