LG patches webOS chain enabling local pre-auth root access
LG has issued a fix for three webOS vulnerabilities that can be chained to give an attacker on the same local network root access to certain smart TVs without a PIN or interaction from the owner. SSD Secure Disclosure published its advisory on October 12, and the chain was demonstrated by an anonymous researcher at TyphoonPWN 2026 in Seoul.
The researchers tested the attack against LG 32LQ636BPSA and 27TQ600SW televisions running webOS 7.5.7-25 on firmware 04.54.40. It is not known whether other TV models or firmware releases are affected. LG has provided an update, while owners who cannot install it have no stated workaround.
How the webOS attack chain reaches root
The entry point is a service exposed on port 3001 for pairing with the LG ThinQ app. An attacker on the same local network can replay a manifest from sync-demo, a built-in application already present on the TV. That manifest is signed with a test certificate trusted by the firmware.
A permission defined in the manifest makes the pairing service bypass its PIN prompt and return a privileged key. The attacker can use that key to start another built-in application, cmp-client, and direct it to a page under the attacker’s control.
cmp-client does not validate its navigation destination. The loaded page retains access to PalmServiceBridge, an internal interface for webOS system services. Through this interface, the chain invokes the system logging service, pmlogd, and supplies shell commands through an input field that the service fails to validate.
Because pmlogd runs with root privileges, those injected shell commands execute as root. The reported issue is therefore a pre-authentication local-network compromise path rather than a flaw requiring a user to approve pairing or open content.
Local-network exposure remains significant
This is not the first webOS root-access issue involving services reachable from a local network. Bitdefender disclosed a separate set of webOS vulnerabilities in 2024 that enabled unauthenticated network access through different components; those issues were patched in March 2024. A different chain shown at TyphoonPWN 2025 relied on path traversal through another port.
The newly demonstrated chain has no assigned CVE identifiers, and no exploitation in the wild has been reported. The researcher won third place in the LG webOS category at TyphoonPWN 2026, which took place in May.
What TV owners and organisations should do
Owners of the tested models should check for the LG firmware update and install it where available. Since the scope beyond the tested devices is unknown and no workaround has been identified for unpatched televisions, organisations managing smart displays should include their webOS firmware status in routine local-network asset and patch-management checks.