Quick Takeaways
- Attackers can remotely exploit three chained vulnerabilities in LG webOS TVs to gain root access over the local network without owner interaction, via the port 3001 pairing service.
- The exploit involves reusing a signed manifest from the built-in sync-demo app to bypass PIN prompts and acquire a privileged key.
- With root access, attackers can execute arbitrary shell commands through the internal PalmServiceBridge, potentially compromising the device entirely.
Threat, Attack Techniques, and Targets
This report discusses three vulnerabilities found in LG webOS Smart TVs. An attacker on the same local network can exploit these vulnerabilities to gain root access without needing a PIN or owner interaction. The attack begins through a service on port 3001, used by LG ThinQ app for pairing. The attacker replays a manifest file from a built-in app called sync-demo. This file is signed with a test certificate that the TV’s firmware trusts. A permission in the manifest allows the pairing service to skip the PIN prompt and give the attacker a privileged key. With this key, the attacker can use another built-in app to load a malicious webpage. The webpage can access internal system interfaces, enabling the attacker to run commands with root privileges. The vulnerabilities were tested on two models: 32LQ636BPSA and 27TQ600SW, with webOS version 7.5.7-25. Whether other models are affected remains unknown.
Impact, Security Implications, and Remediation Guidance
The vulnerabilities allow an attacker on the same network to take full control of affected LG smart TVs. This includes executing commands as the root user, which could lead to data theft, system interference, or device disruption. The attack is serious because it does not need user interaction and exploits the TV’s trust in signed built-in apps. LG has released a firmware update that fixes these vulnerabilities. Owners should check for and install this update immediately. If users cannot update their devices yet, there are no known workarounds. For detailed guidance, users should contact LG or consult their official security advisories.
Continue Your Tech Journey
Explore the future of technology with our detailed insights on Artificial Intelligence.
Discover archived knowledge and digital history on the Internet Archive.
ThreatIntel-V1
