LG Smart TVs Vulnerable to Pre-Auth Root Takeover From Local Network

What happened

The chain was tested on two TV models, the 32LQ636BPSA and the 27TQ600SW, running webOS 7.5.7-25 on firmware 04.54.40. No workaround is available for those who cannot update yet.

An attacker replays a manifest from sync-demo, a built-in app already on the device, signed with a test certificate the firmware trusts. Three vulnerabilities in LG's webOS can be chained to give an attacker on the same local network root access to certain smart TVs without a PIN or any interaction from the owner. LG is a conglomerate company based in Seoul.

LG has issued a fix, according to an advisory published by SSD Secure Disclosure on October 12. LG Smart TVs Vulnerable to Pre-Auth Root Takeover From Local Network  Swati Khandelwal  Oct 13, 2026 Vulnerability / IoT (everyday devices connected to a network) Security Three vulnerabilities in LG's webOS can be chained to give an attacker on the same local network root access to certain smart TVs without a PIN or any interaction from the owner.

Whether other models or firmware versions are affected is not known. Owners of affected TVs should check for a firmware update. The attack enters through a service that the TV exposes on port 3001, which is used by the LG ThinQ app for pairing.

Key facts

• The chain was — tested: on two TV models, the 32LQ636BPSA and the 27TQ600SW, running webOS 7.5.7-25 on firmware 04.54.40