Researchers Discover LG Smart TV Vulnerabilities Allowing Root Access

Many security vulnerabilities have been disclosed in LG webOS jogging on its sensible televisions that could be exploited to bypass authorization and achieve root obtain on the units.

The findings come from Romanian cybersecurity business Bitdefender, which identified and described the flaws in November 2023. The issues were set by LG as part of updates released on March 22, 2024.

The vulnerabilities are tracked from CVE-2023-6317 by way of CVE-2023-6320 and effect the adhering to variations of webOS –

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

• webOS 4.9.7 – 5.30.40 managing on LG43UM7000PLA
• webOS 5.5. – 04.50.51 functioning on OLED55CXPUA
• webOS 6.3.3-442 (kisscurl-kinglake) – 03.36.50 functioning on OLED48C1PUB
• webOS 7.3.1-43 (mullet-mebin) – 03.33.85 working on OLED55A23LA

A transient description of the shortcomings is as follows –

• CVE-2023-6317 – A vulnerability that permits an attacker to bypass PIN verification and insert a privileged person profile to the Tv set established with out demanding user interaction

• CVE-2023-6318 – A vulnerability that makes it possible for the attacker to elevate their privileges and attain root entry to get handle of the system

• CVE-2023-6319 – A vulnerability that enables running program command injection by manipulating a library named asm responsible for showing music lyrics

• CVE-2023-6320 – A vulnerability that allows for the injection of authenticated instructions by manipulating the com.webos.service.connectionmanager/television/setVlanStaticAddress API endpoint

Effective exploitation of the flaws could permit a danger actor to obtain elevated permissions to the product, which, in flip, can be chained with CVE-2023-6318 and CVE-2023-6319 to get hold of root accessibility, or with CVE-2023-6320 to operate arbitrary instructions as the dbus user.

“Despite the fact that the susceptible company is supposed for LAN obtain only, Shodan, the research motor for Internet-related gadgets, identified above 91,000 equipment that expose this company to the Internet,” Bitdefender mentioned. A bulk of the equipment are situated in South Korea, Hong Kong, the U.S., Sweden, Finland, and Latvia.

Uncovered this post attention-grabbing? Observe us on Twitter  and LinkedIn to browse much more special material we put up.