LG Smart TVs Vulnerable to Pre-Auth Root Takeover From Local Network
LG Smart TVs vulnerable to pre-auth root takeover from local network.
Run LG?
Get an email when a reviewed story names LG, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Three vulnerabilities in LG's webOS have been discovered that can be chained together to grant an attacker on the same local network root access to certain smart TVs. This takeover can occur without requiring a PIN or any user interaction. LG has released a fix for these vulnerabilities.
The lesson from this incident
Full lessonThree chained vulnerabilities in LG's webOS allowed an attacker on the same local network to gain root access to smart TVs without any PIN or user interaction, representing a critical failure in secure-by-default device design. IoT and smart home devices are frequently overlooked in patch cycles, leaving them exposed long after fixes become available. This matters because compromised smart TVs can serve as pivot points for deeper network intrusions, enabling attackers to move laterally to more sensitive systems. LG has released a patch, but the window of exposure highlights how unmanaged consumer and enterprise IoT devices remain a persistent blind spot in network security posture.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network segmentation and microsegmentation
One compromised machine can no longer reach everything else.
Indicators of Compromise
- cve — CVE-2023-3597
- cve — CVE-2023-3598
- cve — CVE-2023-3599