LG Smart TVs Vulnerable to Local Network Root Takeover

On October 12, LG announced a security fix after SSD Secure Disclosure released an advisory detailing how three vulnerabilities in its webOS platform can be chained to give an attacker on the same local network root access to certain smart TVs without needing a PIN or user interaction.¹

The exploit chain was tested against two LG television units—the 32LQ636BPSA and the 27TQ600SW—both running firmware version webOS 7.5.7‑25.¹

Security specialists explain that the flaw stems from a misconfigured OAuth flow within webOS. This allows a device on the same LAN (typically within ten meters) to impersonate legitimate applications and obtain privileged credentials, similar to earlier Samsung smart TV issues where default remote‑access APIs were not properly secured against local spoofing attacks.¹

Because the vulnerability bypasses standard authentication protocols, it lets attackers install malicious apps without user consent. That risk increases when the TV’s microphones or cameras are active. Expert notes emphasize that patching promptly is essential; failure to update could leave vulnerable populations such as elderly individuals who rely heavily on connected home appliances at greater risk.

LG’s remediation strategy involves revoking existing app authorizations whenever a new webOS version is installed—a common mitigation technique across IoT platforms facing privilege escalation threats caused by weak authentication mechanisms. By enforcing this reset, the company aims to close the attack surface exposed by the OAuth misconfiguration and prevent attackers from maintaining persistent root access after an initial compromise.¹

The incident underscores how convenience features—centralized account systems and streamlined firmware updates—can unintentionally create broad attack surfaces when underlying security controls are inadequately hardened. It also highlights the ongoing need for manufacturers to adopt robust authentication flows that resist local network adversaries, especially as consumer devices increasingly integrate sensitive sensors and connectivity options.

Users should verify their LG television model number and ensure they have applied any available firmware updates released after October 12. Updating protects against unauthorized root takeover and safeguards personal data accessed through the TV’s microphones, cameras, and other integrated services. Failure to act could expose users to privacy violations and potential manipulation of household appliances that depend on those smart TVs.