LG webOS Flaws Let Remote Attackers Execute Commands as Root Without Authentication

Security researchers have disclosed four serious vulnerabilities in LG webOS smart TVs that could allow an attacker to bypass authentication, create a privileged account, and ultimately execute commands with root-level access.

The flaws, tracked as CVE-2023-6317 through CVE-2023-6320, affect selected LG TV models running webOS versions 4 through 7.

Bitdefender researchers said the issue could give an attacker full control of a vulnerable television if it is reachable on the same local network.

In some cases, the risk could extend beyond the home network because researchers found more than 91,000 exposed devices through Shodan. This search engine indexes internet-connected services. Bitdefender said LG fixed the reported issues before it publicly released the research in April 2024.

The most important flaw, CVE-2023-6317, affects the pairing process used by the LG ThinQ mobile app. Normally, when setting up the app, a user must enter a PIN displayed on the TV before the app can gain access.

LG webOS Flaws

Bitdefender found that a weakness in the webOS account-registration process could let an attacker skip that PIN verification and create a user profile with elevated permissions.

The problem involved how the system handled client-key and companion-client-key values. An attacker could first request a low-permission account, obtain its client key, and then reuse that key while requesting another account with higher permissions.

The TV verified that the key existed but did not properly confirm that it belonged to the account being created. That allowed the request to avoid the on-screen PIN prompt.

Once the attacker created a privileged account, they could access services unavailable to normal unauthenticated users. This is where the remaining flaws become important.

CVE-2023-6318 and CVE-2023-6319 are command-injection vulnerabilities that can be used to run operating system commands. CVE-2023-6320 affects a network configuration endpoint and can run commands under the dbus account, which researchers said has permissions close to root.

For readers following smart-TV security issues, Cyber Security News previously reported that more than 90,000 LG TVs were exposed to authorization bypass risks, highlighting how internet exposure can turn a local-network weakness into a wider concern.

Bitdefender confirmed the flaws on several webOS builds, including webOS 4.9.7, 5.5.0, 6.3.3-442, and 7.3.1-43. The tested devices included the LG43UM7000PLA, OLED55CXPUA, OLED48C1PUB, and OLED55A23LA.

CVE-2023-6317 affected all four tested webOS versions and enabled the authentication bypass. CVE-2023-6318 was confirmed on webOS 5.5.0, 6.3.3-442, and 7.3.1-43. CVE-2023-6319 affected all tested versions, while CVE-2023-6320 affected webOS 5.5.0 and 6.3.3-442.

The full chain is particularly concerning because it combines a simple authorization bypass with command execution. A threat actor would not need a TV owner to approve a pairing request or enter a PIN.

After obtaining elevated access, they could change settings, install unwanted software, access connected services, or use the TV as a foothold inside a home network.

LG’s Product Security Response Center publishes security bulletins for product issues, and the company says smart TVs receive software and security updates at least once a year for at least two years after launch. LG also says its security update period lasts five years from the webOS platform launch date.

Owners should turn on automatic software updates and manually check the TV’s firmware version through the device settings. Updating is especially important after unboxing a TV that may have sat in storage for months before you connect it to the internet.

Users should also avoid exposing smart TVs directly to the internet through router port forwarding, keep home routers patched, and, where possible, place IoT devices on a separate guest or IoT network. These steps reduce the chance that an outside attacker can reach a vulnerable TV or use it to move deeper into a home network.

Stops threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC