LG webOS local-network root chain, no PIN required
pre-auth root on tested LG smart TVs from the LAN

LG webOS local-network root chain, no PIN required

On 12 October 2026 SSD Secure Disclosure published a three-stage chain against LG webOS. An attacker already on the same local network can reach root command execution on certain smart TVs without a PIN and without any action from the owner. LG has issued a fix. The published research does not assign CVE identifiers, and it does not report exploitation in the wild.

What happened

The chain was demonstrated on the LG 32LQ636BPSA and 27TQ600SW, running webOS 7.5.7-25 and firmware 04.54.40. It starts at a WebSocket service on port 3001 used for ThinQ pairing. The attacker replays a signed manifest from the built-in sync-demo application and abuses a trusted internal-connection permission to obtain a privileged client key without the normal PIN prompt.

A later stage reaches a web component that can call PalmServiceBridge. The last step hits the pmlogd logging service, which runs as root. SSD says attacker-controlled target directory and file values are folded into shell commands without enough checks, so injected commands run as root. Whether other models or firmware builds are affected is not stated.

Who is affected

  • Sites that put LG smart TVs on the same LAN as laptops, servers, or guest devices
  • The two tested models on webOS 7.5.7-25 / firmware 04.54.40, until LG's fix is installed
  • Other webOS sets only if LG's bulletin later names them; do not assume a model is safe or unsafe from this write-up alone

What to do now

Put smart TVs on a guest or IoT VLAN that cannot reach servers, workstations, or management interfaces, and install LG's webOS fix on any set that offers it. Do not treat a conference-room TV as a trusted device. Block inbound access to TV management ports from the corporate LAN. This is a local-network issue, not an internet worm, but a compromised laptop on the same Wi-Fi is enough.

Source: SparTech Software summary of the SSD advisory. Reporting: The Hacker News, 13 October 2026.

Also on the blog

Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.

SAP Cloud SDK CVE-2026-89111 CVSS 10 OAuth2 SSRF
tenant_subdomain redirects steal BTP client credentials