Which LG TV models are affected?

32LQ636BPSA and 27TQ600SW with webOS 7.5.7-25 firmware 04.54.40.

Is a user PIN required to exploit the flaw?

No, the attack chain bypasses the PIN prompt via a signed manifest.

How can owners mitigate the risk?

Apply the latest firmware update released by LG; no workaround exists for unpatched devices.

LG Smart TV root takeover via local-network pre-auth chain

LG Smart TVs running webOS 7.5.7-25 are vulnerable to a local-network root takeover chain that requires no PIN or user interaction. The chain operates entirely over the local network and targets a service exposed on port 3001, the same port used by the LG ThinQ app for device pairing.

Attack Path

Service exploitation – The attacker sends a replayed manifest from the built-in sync-demo app. The manifest is signed with a test certificate that the firmware trusts. A permission in the manifest causes the pairing service to skip the PIN prompt and hand over a privileged key.
Privilege escalation – With the privileged key, the attacker launches the built-in cmp-client app and points it to an attacker-controlled page. The app does not validate the navigation target, allowing the page to access PalmServiceBridge, an internal interface to system services.
Command injection – Through PalmServiceBridge, the attacker calls the system logging service, pmlogd, passing shell commands via an unchecked input field. Since pmlogd runs as root, the injected command executes with root privileges.

The entire chain requires only local network access and no authentication from the TV owner.

Affected Products

Model 32LQ636BPSA – 32-inch LED TV
Model 27TQ600SW – 27-inch LED TV

Both models run webOS 7.5.7-25 with firmware 04.54.40. It is unclear whether other models or firmware versions contain the same flaw.

Evidence and Validation

The chain was reproduced by an anonymous researcher who earned third place in the LG webOS category at TyphoonPWN 2026. No CVE identifiers have been assigned, and no exploitation in the wild has been reported. The vulnerability was documented in an SSD Secure Disclosure advisory published on October 12, 2026.

Mitigation

LG has issued a firmware update that patches the three webOS flaws. Owners of the affected models should download and install the latest firmware immediately. No workaround exists for devices that cannot be updated.

Historical Context

LG’s smart TVs have faced similar local-network attacks before. In 2024, Bitdefender disclosed a different set of webOS vulnerabilities that also allowed unauthenticated local-network access and were patched in March 2024. A separate chain demonstrated at TyphoonPWN 2025 used a path traversal on a different port. The recurrence of local-network root exploits in LG’s webOS stack highlights a persistent design issue.

Operational Impact

Root access on a smart TV enables an attacker to install persistent malware, exfiltrate data, or use the device as a foothold for further network attacks. The lack of a PIN requirement means that any device on the same local network is a potential target.

Next Steps for Operators

Inventory – Verify whether any LG Smart TVs in the environment match the affected models and firmware.
Patch – Apply the LG firmware update as soon as it is available.
Segmentation – Isolate smart TVs on a separate VLAN or subnet to limit local-network exposure.
Monitoring – Watch for anomalous traffic on port 3001 and for unexpected root-level processes on the TV.

LG Smart TV root takeover via local-network pre-auth chain