Three vulnerabilities in LG’s webOS can be chained to give an attacker on the same local network root access to certain smart TVs without a PIN or any interaction from the owner.
LG has issued a fix, according to an advisory published by SSD Secure Disclosure on October 12.
The chain was tested on two TV models, the 32LQ636BPSA and the 27TQ600SW, running webOS 7.5.7-25 on firmware 04.54.40. Whether other models or firmware versions are affected is not known.
Owners of affected TVs should check for a firmware update. No workaround is available for those who cannot update yet.
The attack enters through a service that the TV exposes on port 3001, which is used by the LG ThinQ app for pairing. An attacker replays a manifest from sync-demo, a built-in app already on the device, signed with a test certificate the firmware trusts. A permission in the manifest causes the pairing service to skip the PIN prompt and hand over a privileged key.
With that key, the attacker launches another built-in app, cmp-client, and points it to an attacker-controlled page. The app does not check where it navigates, and the loaded page keeps access to PalmServiceBridge, an internal interface to the TV’s system services.
Through that bridge, the attacker calls the system logging service, pmlogd, passing shell commands through an input field the service does not check. Because pmlogd runs as root, the injected command runs as root.
This is not the first time the local network attack surface has led to root access on LG smart TVs. In 2024, Bitdefender disclosed a different set of webOS vulnerabilities that also allowed unauthenticated access from the network, affected different components, and were patched in March 2024. A separate chain demonstrated at TyphoonPWN 2025 used a path traversal on a different port.
The chain was demonstrated by an anonymous researcher who won third place in the LG webOS category at TyphoonPWN 2026, held in Seoul in May. No CVE identifiers have been assigned, and no exploitation in the wild has been reported.
