LG Smart TVs Exposed: Pre-Auth Root Takeover via Local Network

LG Smart TVs Exposed: Pre-Auth Root Takeover via Local Network

A trio of security flaws in LG's webOS has been found to allow an attacker on the same local network to gain root access to certain smart TVs without any authentication or user interaction. The vulnerabilities, detailed in an advisory published by SSD Secure Disclosure on October 12, were tested on two LG TV models: the 32LQ636BPSA and the 27TQ600SW, both running webOS 7.5.7-25. LG has since released a fix.

The chain, which requires the attacker to be on the same network as the TV, bypasses the need for a PIN or any action from the device owner. This means that in shared environments—such as homes, offices, or hotels—a malicious actor could potentially seize full control of the TV.

The Vulnerabilities

While the advisory does not disclose the specific technical details of each flaw, it confirms that three separate issues can be combined to achieve pre-authentication root access. The attack likely exploits weaknesses in webOS services that are exposed to the local network, such as those used for remote control apps or device discovery. By chaining these vulnerabilities, an attacker can escalate privileges from an unauthenticated network position to the highest level of access on the device.

SSD Secure Disclosure, which published the findings, is a platform that coordinates the disclosure of security vulnerabilities. The advisory indicates that LG was notified and has issued a patch, though it is unclear whether the fix has been automatically applied to all affected devices or if users need to manually update their TVs.

Impact and Risks

Gaining root access to a smart TV is not just about changing channels. An attacker with root privileges can install persistent malware, eavesdrop on the device's microphone and camera (if present), access stored credentials, and pivot to other devices on the network. In a corporate setting, a compromised TV could serve as a foothold for further intrusion into the internal network.

The fact that no user interaction is required makes this particularly dangerous. An attacker only needs to be on the same local network—whether via a shared Wi-Fi or a compromised router—to exploit the chain. This lowers the barrier for exploitation, as no phishing or social engineering is necessary.

Affected Models and Firmware

The vulnerabilities were confirmed on the LG 32LQ636BPSA and 27TQ600SW models running webOS 7.5.7-25. However, it is possible that other models running the same or earlier versions of webOS are also affected. LG has not publicly disclosed the full list of impacted devices, but users are advised to check for firmware updates.

LG's Response

According to the advisory, LG has addressed the vulnerabilities. The company has a history of responding to security issues in its smart TVs, but the patch may not be automatically installed on all devices. Users should manually check for updates via the TV's settings menu to ensure they are protected.

Mitigation and Recommendations

For consumers and organizations using LG smart TVs, the following steps can help reduce risk:

• Update firmware immediately: Ensure your TV is running the latest version of webOS. Check for updates in the settings.
• Segment networks: Place smart TVs on a separate VLAN or guest network to limit an attacker's ability to reach other devices.
• Disable unnecessary features: If you don't use features like remote control apps or screen mirroring, consider disabling them.
• Monitor network traffic: Unusual outbound connections from a TV could indicate compromise.

The Bigger Picture

This incident highlights the growing security challenges posed by IoT devices, particularly smart TVs that often run outdated software and lack robust security measures. As these devices become more integrated into our homes and workplaces, the need for timely patches and network segmentation becomes paramount.

While LG has fixed these specific flaws, the underlying issues—such as exposed network services and weak authentication—are common in the IoT ecosystem. Manufacturers must prioritize security by design, and users must remain vigilant about updates.

For now, LG TV owners should verify their firmware version and apply any available updates. In shared network environments, extra caution is warranted.

Source: The Hacker News