LG webOS: Three-Flaw Chain Enables Pre-Auth Root Takeover from Local Network Without PIN

LG released a firmware update on October 12, 2026, for three vulnerabilities in webOS that, when chained, allow an attacker on the same local network to gain root access on certain smart TVs without knowing the PIN and without any user interaction. The chain was demonstrated at TyphoonPWN 2026, confirming a recurring pattern of security weaknesses in the operating system powering LG televisions.

The Three-Stage Chain: From Test Manifest to Root Shell

The attack path begins on TCP port 3001, used by the LG ThinQ app for pairing televisions with mobile devices. The attacker replays a manifest of the built-in sync-demo app, signed with a test certificate that the firmware treats as trusted. This permission, STB_INTERNAL_CONNECTION, bypasses the PIN prompt and returns a privileged key.

With this key, the attacker launches cmp-client, another preinstalled application, redirecting it to an attacker-controlled web page. The loaded page retains access to PalmServiceBridge, the internal interface that connects apps to webOS system services. Through PalmServiceBridge, the attacker invokes the collectAllLog method of the pmlogd service, which handles system logging.

The collectAllLog method constructs shell commands using caller-controlled values: the targetDir parameter is not sanitized. pmlogd runs as root. Injected commands execute with maximum privileges.

Tested Models and Uncertain Scope

The chain was verified on the 32LQ636BPSA and 27TQ600SW models, both running webOS 7.5.7-25 and firmware 04.54.40. According to the cited source, it is unknown whether other models or firmware versions are affected. This limitation makes it impossible to quantify the real attack surface: LG televisions with webOS span dozens of models and generations, but only these two are confirmed vulnerable in the context of the demonstration.

The SSD Secure Disclosure advisory, dated October 12, 2026, states that LG released a patch. The source does not specify the exact availability date of the update nor the corrected firmware versions per model. Users unable to update firmware have no documented alternative workarounds.

The TyphoonPWN Context and Researcher Anonymity

The chain was demonstrated by an anonymous researcher who placed third in the LG webOS category at TyphoonPWN 2026, held in Seoul in May 2026. TyphoonPWN is a security competition that rewards exploits against consumer devices; the dedicated LG webOS category indicates the television operating system receives structured attention from the offensive research community.

The sources do not comment on the researcher's choice of anonymity. The absence of CVE identifiers and the absence of reports of exploitation in the wild are both explicitly stated by the source. This does not preclude that CVE assignment is in progress: the brief does not document the status of the registration process.

"Three vulnerabilities in LG's webOS can be chained to give an attacker on the same local network root access to certain smart TVs without a PIN or any interaction from the owner" — Swati Khandelwal, The Hacker News

A Recurring Pattern: Since 2024 LG Accumulates Local Network Vulnerabilities

This is not the first time webOS has exposed local-network attack surfaces. In 2024, Bitdefender researchers identified similar vulnerabilities, patched by LG in March 2024. In 2025, a chain presented at TyphoonPWN exploited path traversal on a different port. The temporal recurrence — three episodes in three years, all with local-network vectors and privilege escalation goals — raises questions about the maturity of LG's security development lifecycle for widely deployed IoT devices.

Smart TVs represent an edge case in IoT security: permanently connected, rarely updated by users, often placed in environments with high device density (hotels, offices, waiting rooms) where network segmentation is weak or absent. The threat model the sources describe — attacker on the same LAN, no user interaction, no PIN — fits these contexts particularly well.

Why It Matters

The brief does not document specific remedial measures beyond the firmware update. The dossier does not specify the nature of data exposed on vulnerable devices, nor whether root access enables persistence or lateral movement to other systems on the network. The source does not indicate whether LG has formally acknowledged the vulnerabilities via its own advisory or only through the SSD Secure Disclosure report.

The most relevant datum for the reader remains the absence of workarounds: those who cannot or do not know how to update firmware remain exposed. In a market where smart TVs have 5-7 year lifecycles but receive active updates for only 2-3 years, this operational limit is significant.

The recurring pattern of vulnerabilities in webOS — all with local-network vectors, all with authentication bypasses, all demonstrated in offensive competitions — suggests the operating system's security architecture has not undergone substantial restructuring. The presence of test certificates in production firmware, the retention of built-in apps with privileged permissions, and the lack of input sanitization in system services are structural weaknesses that point patches do not resolve.

FAQ

Which LG models are confirmed vulnerable?

Only the 32LQ636BPSA and 27TQ600SW with webOS 7.5.7-25 and firmware 04.54.40. Other models have not been tested according to available sources.

Does the attack work from the remote internet?

No. The attacker must be on the same local network as the smart TV. The source does not describe remote variants of the same vector.

Have CVEs been assigned to these vulnerabilities?

Sources explicitly state that no CVE has been assigned at the time of publication. It is not documented whether assignment is in progress.

Information is based on the cited advisory and current as of publication.

Sources

• https://thehackernews.com/2026/10/lg-smart-tvs-vulnerable-to-pre-auth.html
• https://www.rapid7.com/blog/post/etr-critical-cisco-catalyst-sd-wan-manager-api-authentication-bypass-exploited-in-the-wild-cve-2026-76504
• https://www.infosectoday.io/lg-smart-tvs-vulnerable-to-pre-auth-root-takeover-from-local-network/?doing_wp_cron=1791893932.2225608825683593750000
• https://www.guardianmssp.com/2026/10/13/lg-smart-tvs-vulnerable-to-pre-auth-root-takeover-from-local-network/
• https://cyberupdates365.com/lg-smart-tv-flaws-root-takeover/
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://www.rapid7.com/platform/
• https://www.rapid7.com/products/command/attack-surface-management-asm/

Information is based on the cited source and current as of publication.

Sources