LG has disclosed three webOS vulnerabilities in its smart TVs that can be chained from a local network to give an attacker root access on certain devices, without requiring a PIN or any owner interaction. The chain was demonstrated on two models, the 32LQ636BPSA and the 27TQ600SW, running webOS 7.5.7-25 on firmware version 04.54.40. LG has published a fix following an advisory from SSD Secure Disclosure dated 12 October 2026. The researchers noted that it is not yet known whether other models or firmware versions are affected.
The attack surface centres on a service exposed by the TV on port 3001 used by the LG ThinQ app for pairing. An adversary can replay a manifest from the built‑in app sync-demo, signed with a test certificate trusted by the firmware, causing the pairing service to bypass the PIN prompt and hand over a privileged key. With this key, the attacker launches another built‑in app, cmp-client, redirecting it to an attacker‑controlled page.
The loaded page maintains access to PalmServiceBridge, an internal interface to the TV’s system services. Through that bridge, the attacker can invoke the system logging service, pmlogd, and pass shell commands that run with root privileges, enabling a full device takeover. The advisory notes that this sequence has not, at present, been observed in the wild. Owners of affected TVs should update to the patched firmware; no workaround is available for those unable to update.