Recent discoveries have unveiled critical vulnerabilities in LG’s webOS that could permit unauthorized root access to specific smart TV models via a local network. These security flaws, identified in an advisory by SSD Secure Disclosure on October 12, 2026, underscore significant risks for IoT security in smart home devices.
According to the advisory, the vulnerabilities impact the LG TV models 32LQ636BPSA and 27TQ600SW, both operating on webOS version 7.5.7-25 with firmware 04.54.40. The potential for exploitation on other models or firmware versions remains unclear, raising concerns among users and security experts alike.
Understanding the Exploitation Mechanism
Exploitation of these vulnerabilities begins via a service operating on port 3001, primarily used by the LG ThinQ app for device pairing. An attacker can manipulate this service by replaying a manifest from the sync-demo app, pre-installed on the TV, which is signed with a trusted test certificate. This maneuver effectively bypasses the PIN verification process, granting the attacker a privileged key.
With this key, the attacker can execute the cmp-client app and direct it to a malicious webpage. The app fails to verify the destination, allowing the page to exploit the PalmServiceBridge, which bridges to the TV’s internal system services. This flaw enables the injection of shell commands via the system logging service, pmlogd, which operates with root privileges.
Historical Context and Previous Incidents
This incident is not isolated in LG’s history of network-related vulnerabilities. In 2024, Bitdefender revealed a separate set of webOS vulnerabilities that also facilitated unauthorized network access, affecting different system components. These were resolved in March 2024, yet similar issues resurfaced in 2025, demonstrated at the TyphoonPWN event through a distinct path traversal exploit.
The current vulnerability chain was presented by an anonymous researcher at the TyphoonPWN 2026 event in Seoul, earning them third place in the LG webOS category. As of now, no CVE identifiers have been assigned, and there are no reports of these vulnerabilities being exploited in real-world scenarios.
Mitigation and Future Outlook
With no available workaround for those unable to update, it is imperative for owners of affected LG smart TVs to verify and install the latest firmware updates. LG’s proactive response in issuing a fix highlights the importance of regular security updates in mitigating potential IoT threats.
Looking ahead, the incident underscores the critical need for continuous monitoring and improvement of security measures in smart devices to protect against evolving cyber threats. Users are encouraged to remain vigilant and prioritize security updates to safeguard their digital environments.
