LG Smart TVs Vulnerable to Pre-Auth Root Takeover From Local Network

Three webOS vulnerabilities can be chained to give an attacker on the same local network root access to certain LG smart TVs without a PIN or owner interaction. The chain was tested on the 32LQ636BPSA and 27TQ600SW running webOS 7.5.7-25, and LG has issued a fix.

• Three webOS flaws chain into a root-access exploit
• Attack works from the local network with no PIN or user action
• Tested on 32LQ636BPSA and 27TQ600SW with webOS 7.5.7-25
• LG released a fix, disclosed by SSD Secure Disclosure on October 12