LG Smart TV flaws disclosed in webOS can be chained by an attacker on the same local network to bypass the normal pairing process and ultimately execute commands with root privileges on affected televisions.
The exploit chain was published by SSD Secure Disclosure on October 12, 2026, following research demonstrated during the TyphoonPWN 2026 security competition.
The attack was tested against the LG 32LQ636BPSA and LG 27TQ600SW running webOS 7.5.7-25 with firmware 04.54.40. SSD says LG has issued a fix, but the researchers did not establish that every LG smart TV or every webOS version is affected.
For broader guidance on securing connected devices against network-based attacks, see our Device Security Audit 2026.
Key Takeaway
The LG Smart TV flaws form a three-stage exploit chain that starts with a pairing authentication bypass, continues through a trusted webOS application capable of loading attacker-controlled content, and ends with command injection inside a root-privileged logging service.
The demonstrated attack requires the attacker to be able to reach the TV over the same local network. No CVE identifiers have been assigned to the disclosed issues, and there is currently no evidence of exploitation in the wild.
LG Smart TV Flaws Enable Root Takeover
SSD Secure Disclosure describes the attack as a full exploit chain involving three weaknesses in LG webOS.
The chain consists of:
- A signed manifest replay that bypasses the normal PIN pairing prompt
- An attacker-controlled URL loaded through the built-in
cmp-clientapplication - A command-injection flaw in the
pmlogdlogging service
When combined, these weaknesses allow an unauthenticated attacker on the local network to progress from initial pairing access to command execution with root privileges.
Attack Starts With LG ThinQ Pairing Service
The first stage targets a service exposed by the TV on TCP port 3001, which is used for pairing and remote-control functionality such as communication with the LG ThinQ ecosystem.
According to SSD’s analysis, the attacker can replay a signed manifest already present in the built-in sync-demo application.
The firmware trusts a test signing certificate associated with that manifest. A permission named STB_INTERNAL_CONNECTION causes the pairing logic to skip the normal prompt.
As a result, the attacker can receive a privileged client key without entering the PIN that would normally be required during pairing.
Trusted webOS App Loads Attacker-Controlled Content
After obtaining the client key, the attacker can interact with another built-in application called cmp-client.
The application accepts an interactiveUrl parameter and checks whether the supplied page responds successfully.
SSD found that the application does not sufficiently restrict where that URL can point.
This makes it possible to direct the trusted application to an attacker-controlled web page.
More importantly, the remotely loaded content continues to have access to PalmServiceBridge, an internal webOS interface that can communicate with system services.
LG webOS Vulnerability Reaches Internal Luna Services
The second stage effectively expands what the attacker can reach inside the television.
The attacker-controlled page is loaded inside a trusted webOS application that has broader permissions than a normal external client.
This allows the page to invoke internal Luna service methods that would not otherwise be directly reachable through the original remote WebSocket connection.
That access becomes the bridge to the final command-execution stage.
Command Injection Runs With Root Privileges
The final weakness is located in the webOS logging service pmlogd.
SSD found that the collectAllLog method constructs shell commands using caller-controlled path values.
One of those values, targetDir, is not adequately sanitized before being inserted into a shell command.
An attacker able to reach this method can therefore inject shell metacharacters and execute an arbitrary operating-system command.
The security impact is severe because the affected logging daemon runs with root privileges.
Successful exploitation therefore gives the attacker root-level command execution on the television.
Which LG Smart TVs Were Confirmed Affected?
The published research specifically lists two tested LG products:
- LG 32LQ636BPSA
- LG 27TQ600SW
The tested environment used:
- webOS version: 7.5.7-25
- Firmware: 04.54.40
These versions are the confirmed affected configurations documented by the researchers.
It would be inaccurate to state that all LG smart TVs or all webOS devices are vulnerable based on the currently published evidence.
LG Has Released a Fix
SSD Secure Disclosure says LG issued a fix for the vulnerabilities and points users to LG’s official Product Security bulletin portal.
LG owners should check their television for the latest available firmware rather than relying only on the version number published in the research, because firmware availability can vary by TV model and region.
For at least the tested LG 32LQ636BPSA product family, LG’s support site lists newer firmware than the vulnerable 04.54.40 build.
Users can normally check for updates through the television’s software update settings or the relevant LG support page for their model.
Local Network Access Is Required
This vulnerability chain should not be described as an unrestricted internet-based remote takeover.
The demonstrated attack targets services reachable from the television’s local network.
An attacker would therefore need network access capable of reaching the vulnerable TV, such as access to the same home, office or otherwise reachable LAN environment.
This requirement significantly affects the practical threat model but does not make the issue harmless.
A compromised laptop, malicious IoT device, rogue guest or attacker who already has access to the local network could potentially use a vulnerable smart TV as another target.
No User Interaction or Pairing PIN Required
Within the demonstrated network conditions, the attack does not require the TV owner to approve the pairing request or provide a PIN.
The first vulnerability allows the attacker to bypass that security step by replaying a trusted signed manifest.
The subsequent stages then use built-in functionality to move toward root command execution.
This is why the research describes the chain as pre-authentication remote code execution.
What Could Root Access to a Smart TV Allow?
Root privileges provide the highest operating-system-level authority on the device.
In principle, an attacker with that level of access could alter software, interact with device services, establish persistence or use the television as a foothold for additional activity.
However, the published research primarily demonstrates arbitrary root command execution.
It does not establish that attackers have used this chain in real-world campaigns to spy on users, steal credentials or compromise other systems.
Those possibilities should therefore not be presented as confirmed consequences of this specific vulnerability.
No CVE Identifiers Have Been Assigned
The three vulnerabilities do not currently have publicly listed CVE identifiers in the disclosure.
This means administrators and consumers should not wait for a CVE number before checking whether LG has made a firmware update available for their device.
The absence of a CVE does not reduce the demonstrated technical impact of the chain.
No Active Exploitation Reported
Neither the SSD disclosure nor available reporting indicates that the LG webOS exploit chain is currently being exploited in the wild.
The vulnerabilities were demonstrated through security research and coordinated disclosure.
Users should still update promptly because technical details and proof-of-concept exploit code have now been published.
Researchers Demonstrated the Chain at TyphoonPWN 2026
The exploit chain was demonstrated during TyphoonPWN 2026, a security competition held in Seoul.
SSD says the independent researcher behind the submission placed third in the LG webOS category.
The competition required exploit submissions to work against designated targets under controlled conditions before they could qualify for an award.
LG webOS Has Faced Previous Network-Based Flaws
This is not the first security research showing that LG televisions can expose a meaningful local-network attack surface.
Other researchers have previously disclosed unrelated vulnerabilities affecting webOS components.
Those earlier issues should not be confused with the newly disclosed sync-demo, cmp-client and pmlogd chain.
The new disclosure involves a distinct technical path and a separately patched set of weaknesses.
How LG TV Owners Can Reduce Risk
Owners of LG smart TVs should take several practical steps:
- Install the latest firmware available for the exact TV model
- Enable automatic software updates where supported
- Avoid placing smart TVs on the same unrestricted network as sensitive work systems
- Use a separate IoT or guest VLAN when the router supports network segmentation
- Do not expose smart-TV management ports directly to the internet
- Remove unnecessary or untrusted applications
- Review router client lists for unknown devices connected to the local network
Network Segmentation Can Limit Smart TV Risk
The attack demonstrates why connected televisions should be treated as networked computers rather than passive displays.
Placing IoT devices on a dedicated network can reduce the number of sensitive systems they can directly communicate with.
For home users, this might mean using an IoT or guest Wi-Fi network.
For businesses, segmentation rules can restrict smart displays and conference-room devices from reaching employee workstations, servers and administrative networks.
Frequently Asked Questions
What are the new LG Smart TV flaws?
The disclosure describes three weaknesses that can be chained to bypass pairing, load attacker-controlled content through a trusted application and inject commands into a root-privileged webOS service.
Can attackers take over an LG Smart TV without a password?
On the tested devices, an attacker with local-network access could bypass the normal pairing PIN and eventually execute commands as root.
Can the attack be performed directly over the internet?
The published exploit chain was demonstrated from the same local network. The research does not establish unrestricted internet-based exploitation.
Which LG TVs are affected?
The researchers confirmed the chain on the LG 32LQ636BPSA and LG 27TQ600SW running webOS 7.5.7-25 with firmware 04.54.40. The disclosure does not confirm that all LG TV models are affected.
Has LG patched the vulnerability?
Yes. SSD Secure Disclosure says LG has issued a fix and links to LG’s Product Security bulletin portal.
Are hackers exploiting these LG webOS vulnerabilities?
No confirmed exploitation in the wild has been reported in the published disclosure.
Do the flaws have CVE numbers?
No CVE identifiers are listed for the three disclosed vulnerabilities at the time of publication.
Final Takeaway
The newly disclosed LG Smart TV flaws demonstrate how several individually different weaknesses can be combined into a serious pre-authentication root compromise.
The chain begins by bypassing the normal pairing PIN, uses a trusted webOS application to access internal services and ends with command injection inside a root-privileged logging daemon.
The confirmed attack requires local-network access and has been demonstrated on two specific LG models running webOS 7.5.7-25 and firmware 04.54.40.
LG has issued a fix, and owners should install the latest firmware available for their exact television model.
There is currently no evidence of active exploitation, no CVE identifiers have been assigned, and the available research does not establish that every LG smart TV is affected.
