LG WebOS TV Vulnerability Enables Full Device Takeover by Bypassing Authentication

A security vulnerability in LG WebOS TV systems could allow attackers to gain full control of affected devices by bypassing authentication. The flaw affects LG WebOS 43UT8050 and potentially other versions of the platform. It centres on the browser-service component, which automatically opens port 18888 when USB storage is connected, enabling access to the /getFile?path= API endpoint for arbitrary file downloads without authentication.

The weakness stems from improper validation of the path parameter, creating a path traversal vulnerability that can reach the device’s /var/db/main/ directory, which stores authentication keys for peer clients. With these keys, attackers could impersonate legitimate devices and compromise the secondscreen[.]gateway service, potentially enabling developer mode, installation of unauthorised applications, and full administrative control.

LG has acknowledged the vulnerability and issued security advisory SMR-SEP-2025, available through their official security bulletin portal at lgsecurity.lge[.]com; users are urged to install firmware updates and, where possible, avoid untrusted USB devices. According to LG, proof‑of‑concept code using Docker and Python scripts demonstrates the practical feasibility of the attack.