LG webOS smart TVs exposed to pre-auth root takeover from the local network
On the same network, an unauthenticated attacker can become root on webOS TVs and point them at attacker-controlled servers.
A security researcher published a detailed write-up on October 13 describing how to turn a mainstream LG smart TV into a remote, root-level shell without ever pairing with it. The work, shared by SSD Secure Disclosure and covered by multiple outlets including Cybernews and The Hacker News, traces a three-stage exploit chain that lets an attacker on the same local network execute arbitrary commands as the root user on LG webOS devices, then redirect the device's built-in synchronization service to servers of the attacker's choice. Because no pairing, user interaction, or internet exposure is needed, the chain is especially relevant to household and small-business networks where the TV shares a LAN with many other, frequently less-secure, devices.
How the three-stage chain works
The write-up breaks the takeover into three steps. First, the researcher bypasses the device's client credential requirements so an arbitrary device can connect directly to the TV's service interfaces, sidestepping the pairing handshake that is supposed to gate access. In effect, the TV is coaxed into accepting a connection it should normally have rejected. Second, that access is used to reach an interactive shell by triggering an embedded command-execution flaw, which grants full root privileges because the affected services run on the device's main control board rather than inside a sandboxed, restricted context. Third, with root control in hand, the researcher exploits the TV's built-in synchronization service, changing its configured sync endpoint to a server controlled by the attacker. The synchronization process then downloads a script from the attacker's server and, with elevated privileges, executes it on the device.
Why the result matters
The payoff is effectively a remote, root-level backdoor: rather than merely taking a screenshot or grabbing streaming credentials, an attacker can run the webOS shell as root and install persistent payloads on the TV. The write-up documents an 'LG-Sync-Demo' payload that launches a simple terminal window bearing a fake LG sync banner, demonstrating that arbitrary commands can run on the device and that the synchronization feature can be repurposed as a delivery channel for follow-on code. Because the chain reaches root on the main control board, it is a serious building block for deeper compromise, including lateral network pivoting, persistence across reboots, and the deployment of additional payloads targeted at other devices on the same network. The author frames the result as a proof of concept, but each of the primitives required for a real, weaponized exploit is already present and has been demonstrated end to end.
Affected devices and scope
The demonstration was run against an LG 32LQ636BPSA, a webOS smart TV from around 2017, and a second LG device, the 27TQ600SW, running firmware 04.54.40 on webOS 7.5.7-2, an early-2022 release. The author notes that the same techniques are expected to work on other LG webOS TVs and could even extend to other devices in the household, though newer firmware revisions may introduce mitigations that narrow the attack surface. The work won third place in a TyphoonPWN competition hosted by SSD Secure Disclosure, and the author plans to make the findings public as a full presentation, with a video to follow. It is an early-stage disclosure, so the exact breadth of affected models and the timing of any vendor patches were not fully resolved at the time of reporting.
If you run an LG webOS TV, the practical risk is network-scope rather than internet-scope: an attacker generally needs to be on the same local network as the TV to walk this exploit chain end to end. For home networks that is often a low bar, since guests, smart home devices, and compromised IoT gadgets all share the same LAN. The strongest mitigations are to segment your network so the TV sits on an isolated VLAN, to remove unnecessary services and open ports from the TV, and to apply firmware updates that may close the client-credential and command-execution gaps highlighted in the write-up. For smart home and security researchers, the finding is a reminder that TV operating systems frequently run privileged services that assume their local network is trusted, leaving a persistent root backdoor available to anyone who can reach the device on the LAN.
Sources: Cybernews: LG smart TV vulnerabilities let attackers gain root access; The Hacker News: LG Smart TVs Vulnerable to Pre-Auth Root Takeover From Local Network.
Corrections: Report an error at corrections@wireshaman.com.