Researchers have uncovered a chain of vulnerabilities in LG’s webOS that permits attackers on the same local network to gain root access to certain Smart TVs—without requiring any user interaction or PIN entry. A patch has been issued by LG following a disclosure on October 12, 2026. The flaws were discovered in firmware running version 04.54.40 on webOS 7.5.7-25 on models LG 32LQ636BPSA and 27TQ600SW. It is still undetermined whether other models or firmware are similarly vulnerable.
How the Exploit Works
The attack begins via a service exposed by the TV on port 3001, typically used for pairing with the LG ThinQ app. Attackers replay a manifest from the built-in sync-demo application, signed using a test certificate that the firmware wrongly trusts. This manifest includes permissions that cause the pairing service to bypass its PIN prompt and issue a privileged key.
With the privileged key in hand, an attacker can launch the built-in app cmp-client and direct it to an external page under their control. That page then gains access to PalmServiceBridge, a system interface that grants elevated access. From there, an internal process called pmlogd, which runs as root, can be commanded through an unchecked input parameter to execute arbitrary shell commands, culminating in full root control over the TV.
Historical Context and Exposure Timeline
LG’s local network has been the vector for root-level exploits before. In 2024, Bitdefender disclosed earlier webOS vulnerabilities with similar unauthenticated remote access risks which were patched in March of that year. A separate exploit disclosed during TyphoonPWN 2025 involved path traversal on a different port. The current exploit chain was revealed by an anonymous researcher who placed third in the LG webOS category at TyphoonPWN 2026, held in Seoul in May. To date, there have been no reports of in-the-wild exploitation, and the vulnerabilities have not yet been assigned CVE identifiers.
LG has reportedly released fixes for the identified flaws. Owners of affected TVs should check firmware settings and install any available updates as soon as possible. For anyone unable to update yet, there is currently no workaround that fully mitigates the risk.
This incident underscores ongoing risks in interconnected home devices, particularly Smart TVs that run complex operating systems connected to semi-trusted apps and services. Root access from a local network means that anyone who can join that network—physically or over Wi-Fi—could take full control.
What this means is stark: even everyday devices like televisions are now high-value targets in cybersecurity. As smart home ecosystems deepen, vulnerabilities in seemingly mundane hardware can become attack vectors with serious impact. The absence of user interaction in this exploit chain raises the bar for urgency in secure development practices—especially validating certificates properly, sanitizing permissions and input, and minimizing trusted services exposed on local networks. For LG owners, this is a wake-up call to update firmware—and for the industry, a prompt to scrutinize the trust boundaries built into connected home devices.
