🔴 LG Smart TVs Vulnerable to Pre-Auth Root Takeover From Local Network

Three vulnerabilities in LG's webOS can be chained to give an attacker on the same local network root access to certain smart TVs without a PIN or any interaction from the owner.

LG has issued a fix, according to an advisory published by SSD Secure Disclosure on October 12.

The chain was tested on two TV models, the 32LQ636BPSA and the 27TQ600SW, running webOS 7.5.7-25 on firmware 04.54.40. Whether other models or firmware versions are affected is not known.

Owners of affected TVs should check for a firmware update. No workaround is available for those who cannot update yet.