Researchers have published a chain of three vulnerabilities in LG’s webOS that gives an attacker on the same local network root access to certain LG smart TVs, without a PIN and without the owner doing anything. The advisory, published by SSD Secure Disclosure on October 12, says LG has issued a fix.
The attack starts at a service the TV exposes on port 3001 for pairing with the LG ThinQ app. By replaying a manifest from a built-in app that is signed with a test certificate the firmware trusts, the attacker gets the pairing service to skip the PIN prompt and hand over a privileged key. That key is then used to open another built-in app on an attacker-controlled page, which keeps access to an internal interface for system services. Through it, a command-injection flaw in the logging service, which runs as root, lets the attacker run shell commands as root. The chain was shown by an anonymous researcher who placed third in the LG webOS category at TyphoonPWN 2026 in Seoul. No CVE identifiers have been assigned and no exploitation in the wild has been reported.
This is not the first time the local network has been the way in: Bitdefender disclosed a different set of unauthenticated webOS flaws in 2024 that LG patched in March 2024.
How to check if you’re affected
Affected models confirmed by the researcher are the LG 32LQ636BPSA and the LG 27TQ600SW, running webOS 7.5.7-25 on firmware version 04.54.40. It is not known whether other models or firmware versions are affected. Check your TV’s model number and firmware version in its settings, install any available firmware update, and consult LG’s TV security bulletin for the fix. No workaround is available for owners who cannot update yet, and because the attacker must be on the same network, keeping untrusted devices off your home Wi-Fi (for example on a guest network) narrows the exposure.