LG has fixed a chain of webOS security flaws that could let someone on the same home or office network take control of certain smart TVs, according to The Hacker News. The attack did not require a PIN or any action from the owner, which matters in homes where guests, renters, smart devices, or small-office visitors share WiFi.
What happened
According to The Hacker News, three vulnerabilities in LG’s webOS could be linked together to give an attacker root access to a TV from the local network. Root access means the attacker would have very deep control over the device.
The report says the attack used a service exposed on port 3001, which is used by the LG ThinQ app during pairing. The researcher found a way to bypass the normal PIN prompt, get a privileged key, launch another built-in app, and then pass commands through a system logging service that ran as root.
LG has issued a fix, according to an advisory cited by The Hacker News. No CVE identifiers have been assigned, and the source says no real-world exploitation has been reported.
Who is affected
The attack chain was tested on two models: LG 32LQ636BPSA and LG 27TQ600SW. The tested TVs were running webOS 7.5.7-25 on firmware 04.54.40.
The source says it is not known whether other LG TV models or firmware versions are affected. That means LG TV owners should not assume they are safe just because their exact model was not named.
The risk is local-network based. An attacker would need access to the same network as the TV, such as your home WiFi, guest WiFi, apartment network, or a small-office network. That does not make the issue harmless: many homes have old phones, laptops, smart cameras, game consoles, and visitors’ devices on the same network as the TV.
What to do now
On the LG TV, open Settings, then look for Support or All Settings, then Software Update. Menu names can vary by model, but the goal is to check the TV’s firmware version and install any available update.
Turn on automatic software updates if your LG TV offers that option. Smart TVs are often left alone for years, so automatic updates reduce the chance that a known flaw stays open.
If the TV cannot update yet, limit who can join the same WiFi network. Change your WiFi password if you have shared it widely, and remove devices you do not recognize from your router’s connected-device list.
Put smart TVs and other smart-home devices on a guest network if your router supports it. This can reduce what those devices can reach inside your home network.
Avoid using shared apartment, dorm, hotel, or office networks for sensitive devices when possible. If the TV is on a network you do not control, update it before using connected features.
If your router has settings for device isolation, guest WiFi isolation, or blocking local device-to-device access, consider enabling them for smart TVs and other entertainment devices.
How to protect your home network
This LG issue is a reminder that smart TVs are computers on your network, not just screens. CyberSec24 recommends keeping TVs updated, using guest WiFi for smart-home gear, and reviewing the basics in our home network security guide. Our guide on putting smart devices on guest WiFi is especially relevant for TVs, cameras, speakers, and other devices that do not need full access to laptops and phones.
Sources
- LG Smart TVs Vulnerable to Pre-Auth Root Takeover From Local Network — The Hacker News
Written by the CyberSec24 news desk with AI assistance, from the sources above. Spot an error? Tell us and we'll correct it.