Three vulnerabilities in LG's webOS can be chained to give an attacker on the same local network root access to certain smart TVs without a PIN or any interaction from the owner, according to an advisory published by SSD Secure Disclosure on October 12.
The pairing service on port 3001 is the initial entry point
The chain begins with a service the TV exposes on port 3001, the same port used by the LG ThinQ app for pairing. An attacker on the same local network can connect to that service and replay a manifest from sync-demo, a built-in app already present on the device. The manifest used in the demonstration was signed with a test certificate that the inspected firmware trusts; a specific permission in that manifest causes the pairing service to skip the normal PIN prompt and hand over a privileged key to the requester.
How sync-demo, cmp-client, PalmServiceBridge and pmlogd are chained to gain root
With the privileged key, the attacker launches cmp-client, another built-in app, and directs it to an attacker-controlled web page. The cmp-client app does not validate where it navigates; the loaded page retains access to PalmServiceBridge, an internal interface to the TV's system services. Through that bridge the attacker invokes the system logging service, pmlogd, supplying shell commands via an input field the service fails to check. Because pmlogd runs as root on the tested firmware, any injected command executed through it also runs with root privileges, completing the pre-authenticated takeover without the owner’s involvement.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleTested models, firmware, and LG’s remediation
The researcher who demonstrated the chain tested it on two models: the 32LQ636BPSA and the 27TQ600SW, both running webOS 7.5.7-25 on firmware 04.54.40. The advisory notes that whether other models or firmware versions are affected is not known. According to the SSD Secure Disclosure advisory, LG has issued a fix. Owners of affected TVs are advised to check for a firmware update; the advisory also states that no workaround is available for those who cannot update yet.
Context: prior local-network chains and the TyphoonPWN demonstration
This is not the first time LG’s local-network attack surface has enabled root access on webOS devices. In 2024, Bitdefender disclosed a different set of webOS vulnerabilities that also allowed unauthenticated access from the network; those affected different components and were patched in March 2024. A separate chain demonstrated at TyphoonPWN 2025 used a path traversal on a different port. The chain described in the October 12 advisory was demonstrated by an anonymous researcher who won third place in the LG webOS category at TyphoonPWN 2026, held in Seoul in May. As of the advisory’s publication, no CVE identifiers had been assigned and no exploitation in the wild had been reported.
What this means for owners, technologists, and adversaries
- Owners of affected TVs: Check for the LG firmware update immediately. If an update is available, install it; if not, be aware that the advisory states no workaround exists for those who cannot update yet.
- Technologists and security teams managing device fleets: Verify which models and firmware versions you have in operation against the tested set (32LQ636BPSA and 27TQ600SW on webOS 7.5.7-25, firmware 04.54.40) and apply LG’s patching guidance. Note the chain relies on local-network access and built-in, signed apps, which may influence network segmentation and device hardening priorities.
- Adversaries and red teams: The described chain demonstrates how a combination of trusted test certificates, permissive manifest permissions, and unchecked input fields in privileged services can be combined to escalate to root without user interaction.
The advisory lays out a straightforward — and sobering — technical sequence: replay a trusted manifest, acquire a privileged key, coerce a built-in app to load attacker content with internal service access, and then abuse a root-run logging daemon that fails to validate input. LG has issued a fix, and the immediate practical step is clear for owners: check for and apply firmware updates. What remains an open and concrete question in the advisory is how widely other models and firmware versions are affected; no CVEs have been assigned and no active exploitation has been reported, leaving researchers, administrators, and users dependent on vendor updates and follow-on disclosure to close the loop.
