Critical LG webOS TV Vulnerabilities Allow Remote Root Code Execution

Key Takeaways

• Four critical vulnerabilities (CVE-2023-6317 to CVE-2023-6320) were discovered in LG webOS smart TVs.
• These flaws could allow attackers to bypass authentication, create privileged accounts, and achieve remote root code execution.
• Affected models include LG TVs running webOS versions 4 through 7, with specific builds and devices confirmed vulnerable.
• Over 91,000 potentially exposed devices were identified online, although the primary attack vector is a local network.
• LG has released patches for these vulnerabilities, and users are urged to update their devices immediately.

Cybersecurity researchers have uncovered a series of severe vulnerabilities in LG webOS smart televisions, potentially enabling attackers to gain complete control over affected devices. The four flaws, collectively identified as CVE-2023-6317 through CVE-2023-6320, could allow unauthorized access, creation of high-privilege accounts, and ultimately, remote command execution with root-level permissions.

According to researchers at Bitdefender, these issues could grant a malicious actor full control of a vulnerable television if it is accessible on the same local network. While the primary threat vector is local, a concerning discovery of over 91,000 exposed devices via the Shodan search engine indicates a broader potential risk. Bitdefender confirmed that LG addressed these reported vulnerabilities prior to the public disclosure of the research in April 2024.

Unpacking the Vulnerabilities

The most critical of the identified flaws, CVE-2023-6317, targets the LG ThinQ mobile application’s pairing mechanism. Typically, establishing a connection between the app and the TV requires the user to input a PIN displayed on the television screen. Bitdefender’s investigation revealed a weakness in the webOS account registration process that could allow an attacker to circumvent this PIN verification, subsequently creating a user profile with elevated permissions.

This bypass exploited how the system managed “client-key” and “companion-client-key” values. An attacker could first request an account with minimal permissions, extract its client key, and then reuse this key to request a new account with significantly higher privileges. The TV system would verify the existence of the key but failed to properly confirm its legitimate association with the newly requested account, thereby bypassing the mandatory on-screen PIN prompt.

Once a privileged account was established, the attacker could access services typically restricted to authenticated users. This access then paves the way for exploiting the remaining vulnerabilities.

CVE-2023-6318 and CVE-2023-6319 are command-injection vulnerabilities, allowing the execution of arbitrary operating system commands. Additionally, CVE-2023-6320, affecting a network configuration endpoint, permits command execution under the ‘dbus’ account, which researchers noted possesses permissions nearly equivalent to root.

Affected Devices and Patch Status

Bitdefender validated these vulnerabilities across several webOS builds, including versions 4.9.7, 5.5.0, 6.3.3-442, and 7.3.1-43. Specific devices tested and confirmed vulnerable included the LG43UM7000PLA, OLED55CXPUA, OLED48C1PUB, and OLED55A23LA.

CVE-2023-6317, the authentication bypass, was found to affect all four tested webOS versions. CVE-2023-6318 impacted webOS 5.5.0, 6.3.3-442, and 7.3.1-43. CVE-2023-6319 was present across all tested versions, while CVE-2023-6320 affected webOS 5.5.0 and 6.3.3-442.

The severity of this vulnerability chain lies in its simplicity and potential impact. An attacker could achieve root access without any interaction from the TV owner, such as approving a pairing request or entering a PIN. With elevated access, a threat actor could modify settings, install malicious software, access connected services, or even use the compromised TV as a pivot point to infiltrate other devices within a home network.

LG’s Product Security Response Center publishes security bulletins, and the company states that smart TVs receive software and security updates at least annually for a minimum of two years post-launch. Furthermore, LG specifies a five-year security update period from the webOS platform’s initial release date.

What You Should Do

• Enable Automatic Updates: Ensure your LG smart TV is configured to receive automatic software and security updates. This is the most critical step to protect against known vulnerabilities.
• Manually Check for Updates: Regularly navigate to your TV’s settings menu to manually verify that your firmware is up-to-date, especially after initial setup or if auto-updates are not enabled.
• Avoid Direct Internet Exposure: Do not use router port forwarding to expose your smart TV directly to the internet. This significantly reduces the risk of external attackers reaching your device.
• Maintain Router Security: Keep your home router’s firmware patched and up-to-date to prevent network-level compromises that could affect connected devices.
• Segment Your Network: If possible, place smart TVs and other IoT devices on a separate guest or IoT network. This isolates them from your primary home network, limiting an attacker’s ability to move laterally if a device is compromised.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.