Skip to content
Hacker Posts

LG webOS TVs: pre-auth root chain from the local network, no CVE yet

A three-bug webOS chain disclosed by SSD gives root on LG smart TVs from the same LAN, with no PIN or owner action. LG has shipped a firmware fix; no CVEs assigned.

Published 3 min read
advisorylgwebosexplainer

A researcher chained three webOS vulnerabilities into pre-authentication root on LG smart TVs, reachable by anyone on the same local network with no PIN and no action from the TV's owner. The chain was published by SSD Secure Disclosure on October 12, 2026. No CVE identifiers have been assigned. LG has issued a firmware fix.

What's affected

  • Confirmed on: LG models 32LQ636BPSA and 27TQ600SW, running webOS 7.5.7-25 on firmware 04.54.40.
  • Whether other models or firmware builds are affected is unknown — these are the two the researcher tested.
  • Fix: LG has shipped an update. There is no workaround for owners who cannot update.

How the chain works

The attack starts at the pairing service on TCP port 3001 that the LG ThinQ mobile app uses:

  1. Manifest replay. The attacker replays a manifest signed with a trusted test certificate, defeating the signature check that should gate the pairing/sync flow.
  2. PalmServiceBridge abuse. The replayed manifest reaches the PalmServiceBridge interface, the bridge between web content and native luna-service APIs.
  3. pmlogd command injection. Through the pmlogd logging service, the attacker runs injected shell commands as root.

The result is a full root shell on the TV from an unauthenticated position on the LAN — a hostile device on the same Wi-Fi, a compromised IoT neighbour, or a guest network that isn't actually isolated.

Exploitation status

No exploitation in the wild has been reported. The chain was demonstrated by an anonymous researcher who placed third in the LG webOS category at TyphoonPWN 2026, held in Seoul in May; SSD published the write-up after coordinated disclosure. Treat the public write-up as a head start for anyone building a PoC.

Action checklist

  1. Update the TV firmware now. Settings → Support → Software Update, and enable automatic updates. The fix is LG's only remediation.
  2. Get TVs off your flat LAN. Put smart TVs and other appliances on a separate VLAN / IoT SSID that cannot reach — and cannot be reached from — workstations and servers. This neutralises a same-LAN chain even before a patch lands.
  3. Block inbound TCP 3001 to the TV at the network layer if your gear allows per-device rules; only the ThinQ app on a trusted device should ever reach it.
  4. In managed environments (hospitality, signage, conference rooms), inventory LG panels and their firmware build — these are the deployments where "on the same network" is a room full of strangers.

Context

This is a familiar shape for smart-TV research: a local-network attack surface (a pairing or companion-app service) chained with a signature bypass and a privileged native service. webOS has drawn this kind of attention before, and the recurring lesson is the same — a TV is an internet-connected Linux box with a camera-and-microphone future, and "only reachable from the LAN" is a weak boundary on a network that also carries your laptops. The absence of CVE IDs here doesn't lower the severity; it just means your vulnerability scanner won't flag it. Patch by firmware build, and segment.

Related stories