LG smart TVs vulnerable: attackers can bypass webOS security and gain root
Researchers found hardcoded credentials and other bugs that can be leveraged to seize full control of LG TVs.
LG smart TV platform vulnerable. Image by Cybernews / screenshot from LG website.
Follow us
- LG fixed five high-severity webOS flaws that can give attackers root access to vulnerable TVs.
- Attackers on the same network can target affected TVs without a PIN, prompt, or user action.
- Researchers used hardcoded credentials and weak app checks to bypass pairing and load malicious content.
- Users should update their TV firmware or disconnect vulnerable TVs from the network.
LG’s smart TV platform, webOS, suffers from severe vulnerabilities that enable unauthorized attackers on the network to gain root access, the highest privileges on the system. LG has issued a fix.
Vulnerable webOS components allow remote attackers on the network to completely bypass authentication and gain root access on LG TVs.
SSD Secure Disclosure, a vulnerability acquisition and responsible disclosure platform, released an advisory alerting to bugs that can be chained together to gain complete control.
The exploit chain was tested on 2 devices, LG 32LQ636BPSA and LG 27TQ600SW, running webOS version 7.5.7-2 and firmware 04.54.40.
In September, LG issued a fix, addressing 5 high-severity vulnerabilities in total. It remains unclear how many TV models are affected by the bugs.
An attacker on the same network can target vulnerable TVs without a PIN, pairing prompt, or other user interaction.
The proof of concept is already publicly available – and the only mitigations are to update the TV’s firmware or disconnect it from the network.
How does the exploit work?
To gain initial access to the TVs, researchers simply reused hard-coded credentials already present in one of the device’s apps. A built-in LG webOS demo app, called sync-demo, exposes a digitally signed manifest, a document that specifies what permissions an app has.
Researchers presented (replayed) the manifest to the device, tricking it into skipping the normal pairing procedure and issuing a key for a new client profile, granting those same powerful permissions.
After verification, the signed permissions are copied into the new client profile,the researchers said in the report.
From there, the researchers tricked another trusted webOS app, cmp-client, into loading a malicious website. They found that the app with broad outbound permissions accepts a supplied URL without any meaningful validation.
“There is no scheme check, host allowlist, or origin restriction. The app then navigates to attacker-controlled content.”
The malicious website loaded inside the cmp-client can access the TV’s core hardware and system via a special interface called PalmServiceBridge.
A third bug turns this access into full system control. The researchers found that the webOS logging service runs with root privileges and uses shell commands, but doesn’t properly sanitize the file paths it receives.
A specially crafted path can be expanded and interpreted as an extra command, allowing an attacker to inject commands as root.
