Vulnerabilities
LG Smart TVs: Local Network Flaws Could Let Attackers Take Full Control
Three flaws in LG webOS let attackers on the same Wi-Fi network take over some smart TVs without a PIN. LG has released a fix, but only certain models are confirmed affected so far.
Ross GrantUpdated 3 min read
The short version
Researchers found that some LG smart TVs can be taken over by someone on the same Wi-Fi network, without needing a PIN or any help from the owner. The attack uses three linked flaws in the TV's software. LG has released a fix, but only two models are confirmed affected so far. If you have an LG smart TV, check for updates to stay safe.
What happened?
Three vulnerabilities in LG's webOS allow attackers on the same local network to gain root access to certain LG smart TVs without a PIN or user interaction. The flaws were demonstrated on two models and LG has issued a fix. It is not yet clear if other models are affected.
What is the vulnerability?
According to The Hacker News (opens in a new tab), three separate security flaws in LG's webOS can be combined to let someone on the same local network gain root (full) access to certain LG smart TVs. This means an attacker could control the TV without needing the owner's PIN or any action from the user. The attack was demonstrated on two models: the 32LQ636BPSA and the 27TQ600SW, both running webOS 7.5.7-25 with firmware version 04.54.40. It is not yet clear if other models or firmware versions are affected.
How does the attack work?
The attack starts with a service on the TV that listens on port 3001. This port is used by the LG ThinQ app for pairing the TV with a phone. The attacker replays a special file (a manifest) from a built-in app called sync-demo, which is signed with a test certificate that the TV's firmware trusts. This tricks the TV into skipping the usual PIN prompt and giving the attacker a privileged key.
With this key, the attacker can launch another built-in app, cmp-client, and direct it to a web page they control. The app does not check the destination, so the attacker's page loads and keeps access to an internal system interface called PalmServiceBridge. Using this, the attacker can call a system logging service (pmlogd) and pass it shell commands. Because pmlogd runs as root, these commands run with the highest privileges on the TV.
What has LG done?
LG has released a firmware update to fix these vulnerabilities. The advisory was published by SSD Secure Disclosure on 12 October 2026, and the flaws were demonstrated by an anonymous researcher at the TyphoonPWN 2026 event in Seoul. No CVE identifiers have been assigned yet, and there are no reports of these vulnerabilities being exploited in the wild.
What should owners do?
Owners of the affected TV models should check for and install the latest firmware update as soon as possible. There is no workaround for those who cannot update. If you use an LG smart TV, especially the models mentioned, make sure your device is running the latest available firmware. Keeping your TV off untrusted Wi-Fi networks can also reduce risk.
Previous incidents
This is not the first time LG smart TVs have faced similar issues. In 2024, Bitdefender reported other webOS vulnerabilities that also allowed attackers on the local network to gain unauthorised access. Those were patched in March 2024. Another chain of vulnerabilities was shown at TyphoonPWN 2025, involving a different technical flaw.
What is still unclear?
At this time, only The Hacker News has reported the details, and there is no confirmation from LG or a government agency. It is also not known how many models or firmware versions are affected beyond the two tested. No evidence of real-world attacks has been reported so far.
Claimed vs confirmed
- Unconfirmed
Three vulnerabilities in LG webOS allow root takeover of smart TVs from the local network.
Reported by The Hacker News, based on SSD Secure Disclosure advisory. No confirmation from LG or an official source.
- Unconfirmed
LG has released a fix for the vulnerabilities.
Reported by The Hacker News, citing SSD Secure Disclosure. No official statement from LG.
- Confirmed
Only two TV models (32LQ636BPSA and 27TQ600SW) are confirmed affected.
The Hacker News specifies these models were tested and affected.
- Confirmed
No exploitation in the wild has been reported.
The Hacker News reports there are no known real-world attacks.
The impact
- Money
- No direct costs or losses are reported. If confirmed, LG could face costs for patching and possible regulatory scrutiny. Under UK GDPR, fines can reach £17.5m or 4% of global turnover.
- Reputation
- Repeated local network flaws in LG smart TVs may affect customer trust, especially among security-conscious buyers. The timing of the fix and communication will influence public perception.
- Customers
- Owners of affected LG smart TVs are at risk if their device is on a shared or public network. They should update firmware and avoid connecting TVs to untrusted Wi-Fi.
Why it matters
Anyone with an affected LG smart TV on a shared or public Wi-Fi network could be at risk. Attackers could take full control of the TV, which could include installing malware, spying, or disrupting use. Keeping devices updated is essential for security.
How does it work?
The attack chains three flaws: a pairing service on port 3001 can be tricked into skipping PIN authentication by replaying a manifest signed with a trusted test certificate. This gives the attacker a privileged key, which lets them launch a built-in app and load a malicious page. The page uses an internal interface to send commands to a system logging service running as root, allowing full control of the TV.
Key points
- Three linked flaws in LG webOS allow root takeover from the local network.
- Attackers do not need a PIN or user interaction to exploit the flaws.
- LG has released a fix, but only two TV models are confirmed affected.
- No CVE identifiers or reports of real-world exploitation yet.
- Keeping smart TVs updated and off risky networks reduces exposure.
Sources
The Hacker News
Reference
