LG Smart TVs Vulnerable to Pre-Auth Root Takeover From Local Network
-
Three vulnerabilities in LG's webOS can be chained together to give an attacker on the same local network root access to certain smart TVs, without a PIN or any interaction from the device owner.
The vulnerable platform is webOS, and the chain was tested on two TV models, the 32LQ636BPSA and the 27TQ600SW, running webOS 7.5.7-25 on firmware.
LG has since issued a fix, according to an advisory published by SSD Secure Disclosure on October 12.
Key points:
- Attackers must already be on the same local network as the target TV
- No PIN is required
- No user interaction is required
- Successful exploitation results in root access
There is no indication in the source that a CVE identifier has been assigned, so none is referenced here. Owners of the affected models should check for and apply LG's firmware update as soon as it is available.
Source: The Hacker News
Do you have any of these LG models on your network, and have you already applied the firmware fix?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login