LG Smart TVs at Risk of Attacks, Thanks to 4 OS Vulnerabilities

Researchers at Bitdefender have discovered four vulnerabilities in LG webOS, the operating system for multiple models of its smart television line.

According to the researchers, even though the now vulnerable LG webOS service is supposed to be used in local area networks, scans show that there are reportedly roughly 91,000 exposed devices that are vulnerable to the bugs.

The bugs are a mix of command injection, privilege escalation, and bypass vulnerabilities and are tracked as CVE-2023-6317, CVE-2023-6318, CVE-2023-6319, and CVE-2023-6320. For instance, CVE-2023-6317 can allow an attacker to add an extra user to the TV set, and CVE-2023-6318 can allow a user to use the access "gained in the first step to root and fully take over the device."

They impact webOS 4.9.7-5.30.40 running on LG43UM7000PLA, webOS 5.5.0-04.50.51 running on OLED55CXPUA, webOS 6.3.3-442 (kisscurl-kinglake)-03.36.50 running on OLED48C1PUB, and webOS 7.3.1-43 (mullet-mebin)-03.33.85 running on OLED55A23LA.

The researchers reported their findings to LG in November 2023, but it was only last month that the vendor released security updates. Affected users who have not been alerted to the vulnerabilities or the updates to fix them should go to the TV "Settings," then "Support," and "Software Update," and then click on "Check for Update."