Pierluigi Paganini
April 09, 2024
Bitdefender researchers discovered multiple vulnerabilities in LG webOS running on smart TVs that could be exploited to bypass authorization and gain root access on the devices.
The vulnerabilities discovered by the researchers impact WebOS versions 4 through 7 running on LG TVs.
“WebOS runs a service on ports 3000/3001 (HTTP/HTTPS/WSS) which is used by the LG ThinkQ smartphone app to control the TV. To set up the app, the user must enter a PIN code into the display on the TV screen.” reads the advisory. “An error in the account handler lets an attacker skip the PIN verification entirely and create a privileged user profile.”
The researchers pointed out that despite the vulnerable service is intended for LAN access only, querying Shodan they identified over 91,000 devices that expose the service to the Internet. At this time, the number of exposed devices decreased to 88,000. Most of the Internet-facing devices are in South Korea, Hong Kong, the U.S., Sweden, and Finland.
Below is the list of vulnerabilities discovered by the experts in November 2023:
The vulnerabilities impact the following webOS versions:
Below is the disclosure timeline:
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, smart TVs)
