Security researchers have uncovered four significant vulnerabilities in LG’s webOS smart TVs, which could allow attackers to bypass authentication and execute commands with root privileges. These flaws—cataloged as CVE-2023-6317 through CVE-2023-6320—affect certain models running webOS versions 4 through 7. If an attacker can access the same local network, they may gain complete control over a vulnerable TV. What’s more concerning: over 91,000 exposed devices were discovered via Shodan, indicating risk extends beyond private networks. LG addressed these flaws prior to making the research public in April 2024.
How the Exploits Work
The most severe issue, CVE-2023-6317, lies in the pairing process for the LG ThinQ mobile app. Normally, users must input a PIN displayed on their TV to pair the app. However, due to flawed handling of client-key and companion-client-key values, an attacker who first obtains a low-privilege account’s client key can reuse it to create an account with elevated permissions—without ever seeing or entering the PIN. Essentially, the system checks only that the client key exists, not whether it belongs to the account being registered.
Once elevated access is achieved, the remaining flaws become critical. CVE-2023-6318 and CVE-2023-6319 are command injection vulnerabilities, allowing remote execution of arbitrary operating-system commands. CVE-2023-6320 affects a network configuration endpoint, enabling commands to run under the “dbus” account—a high-privileged user with rights close to root. Together these issues form a potent chain: authorization bypass followed by remote command execution without any additional user interaction.
Affected Devices & Versions
Bitdefender confirmed the vulnerabilities on several webOS versions including 4.9.7, 5.5.0, 6.3.3-442, and 7.3.1-43. Sample devices include LG43UM7000PLA, OLED55CXPUA, OLED48C1PUB, and OLED55A23LA. While CVE-2023-6317 and CVE-2023-6319 influence all tested versions, CVE-2023-6318 was present in webOS 5.5.0, 6.3.3-442, and 7.3.1-43. CVE-2023-6320 impacted versions 5.5.0 and 6.3.3-442.
Mitigation & Best Practices
LG states that each smart TV receives at least one software or security update per year for a minimum of two years after launch. Furthermore, updates continue for five years from the introduction of the webOS platform. Owners should ensure automatic software updates are enabled, and check firmware versions manually if their device has been in storage before connection.
Other protective measures include avoiding direct exposure of TVs to the internet via port-forwarding, keeping routers updated, and isolating IoT devices on separate guest or dedicated networks. These steps significantly reduce the likelihood that an attacker can reach or misuse an exposed device.
Why this matters: These vulnerabilities expose how even supposedly benign devices like smart TVs can become serious entry points into home networks when authentication controls are flawed. Attackers who chain modest authorization bypasses with high-privilege command execution can escalate from minor mischief to full takeover. As smart devices grow more integrated into our homes, manufacturers must tighten pairing mechanisms and privilege separation.
