Three vulnerabilities in LG's webOS smart TV platform can be chained together to hand an attacker root access from the same local network — without a pairing PIN and without any interaction from the owner. LG has issued a fix for the flaws, according to an advisory published by SSD Secure Disclosure on October 12 and covered by The Hacker News. The advisory does not state which models have actually received it.
The attack model is what elevates this above routine IoT bug reporting. The standard user defence against an unfamiliar device attempting to link with a smart TV — declining the pairing request, or simply not approving the on-screen PIN prompt — is effectively neutralised. In this chain the attacker never needs PIN approval and the victim never needs to touch the remote. Anyone able to reach the TV over the network segment it sits on is, in principle, in scope.
The flaws were tested against two LG models, the 32LQ636BPSA and the 27TQ600SW, both running webOS 7.5.7-25. The advisory does not enumerate the full range of affected models or webOS versions, so organisations should assume other sets in the same webOS family carry the same exposure until LG publishes a definitive list.
There is also a gap that should concern anyone running an automated vulnerability programme: no CVE identifiers have been attached to this research. CVE-keyed scanners, asset inventories, and cross-reference feeds will return nothing for webOS sets that are in fact exploitable. This one will not surface through the usual pipeline — the only reliable detection paths right now are reading the SSD Secure Disclosure write-up directly and checking firmware versions on the devices themselves.
Why root on a television matters beyond the television itself is the pivot potential. A compromised set is a foothold on the network segment it occupies — a machine from which an attacker can probe laptops, printers, NAS boxes, and other endpoints sharing the same VLAN. In an office or co-working deployment, a meeting-room display on the corporate LAN is a materially different risk profile than a home TV on an isolated residential network. The same reasoning applies broadly to co-working floors, serviced offices, and hotel or conference audiovisual setups, where displays are routinely placed on shared segments with dozens of unknown devices.
A checklist for teams managing displays
- Patch, then verify. LG's fix is available, but smart TV update mechanisms are notoriously unreliable. Sets parked in meeting rooms or left in standby frequently miss updates for months. After triggering an update, confirm that the firmware or webOS version number actually changed — on most webOS sets this is under Settings → Support → About This TV (the exact path varies by model year). Assuming the update "probably worked" is the most common failure point.
- Segment, but treat segmentation as a stopgap. Placing displays on a dedicated VLAN or an isolated AV network is sensible defence in depth and buys time, but it is not a substitute for patching. Shared-office VLAN designs often still permit traffic between devices, and the segmentation itself can rot as network policies change.
- Reassess how much trust a display gets. Smart TVs increasingly run apps, hold credentials, and sit quietly on networks for years without review. They should be inventoried and treated as untrusted endpoints — not as furniture.
This is not the first time a smart TV vendor has shipped pre-authentication flaws reachable from the local network. Samsung's Tizen platform has previously been the subject of research detailing remotely exploitable bugs in its application store and IPTV stack, and Android TV devices have similarly drawn scrutiny over debugging interfaces and privilege-escalation paths that required no owner interaction. The pattern is consistent — living-room hardware carrying the network exposure of a small server, often with update habits closer to an appliance — though the comparison is one of pattern rather than severity.
The full technical detail is available in the SSD Secure Disclosure advisory. Organisations responsible for displays in shared or semi-public environments should treat webOS 7.5.7-25 sets as in-scope for immediate patching, and watch the advisory for an expanded model list and, potentially, CVE assignments.
LG webOS 智能電視平台存在三個漏洞，可串連利用，讓處於同一本地網絡的攻擊者取得 root 權限——毋須配對 PIN，亦毋須任何用家互動。根據 SSD Secure Disclosure 於 10 月 12 日發布、並由 The Hacker News 報道的安全通告，LG 已為相關漏洞發出修復。通告並未說明實際已接收更新的電視型號。
正是攻擊模式，令此事超越一般 IoT 漏洞通報的層次。用家以往面對陌生裝置嘗試連接智能電視時的標準防禦手段——拒絕配對請求，或單純不批准螢幕上的 PIN 提示——實際上已形同失效。在此漏洞鏈中，攻擊者從不需要 PIN 批准，受害者亦從不需要拿起遙控器。原則上，任何能夠經電視所在網段連線至該電視的人士，均在攻擊範圍之內。
相關漏洞曾於兩個 LG 型號上測試，分別為 32LQ636BPSA 及 27TQ600SW，兩者均運行 webOS 7.5.7-25。通告並未列明所有受影響的型號及 webOS 版本，因此機構應假設同一 webOS 系列的其他型號同樣存在風險，直至 LG 公布確切名單。
另有一點值得任何運行自動化漏洞管理計劃的人士留意：此項研究至今未有分配任何 CVE 編號。以 CVE 為基礎的掃描器、資產清冊及交叉比對情報源，對實際上可被利用的 webOS 電視將一無所獲。此漏洞不會經由慣常流程浮現——目前唯一可靠的偵測途徑，是直接閱讀 SSD Secure Disclosure 的技術報告，並在裝置本身核對 firmware 版本。
為何電視取得 root 權限的重要性超越電視本身？關鍵在於橫向移動（pivot）的潛力。被入侵的電視成為其所在網段的一個據點——攻擊者可藉此探測手提電腦、打印機、NAS 裝置及同一 VLAN 上的其他終端設備。在辦公室或共享工作空間的部署環境中，接駁公司 LAN 的會議室顯示屏，其風險特徵與處於隔離住宅網絡的家庭電視截然不同。同一理據亦普遍適用於共享寫字樓樓層、服務式辦公室，以及酒店或會議場地的音響視覺系統——這些地方的顯示屏經常與數十部來歷不明的裝置置於同一共享網段。
給顯示屏管理團隊的檢查清單
- 先修補，再核實。 LG 的修復已推出，但智能電視的更新機制向來可靠性欠佳。停放在會議室或長期處於待機狀態的電視，經常數個月都錯過更新。觸發更新後，必須確認 firmware 或 webOS 版本編號確實已改變——大部分 webOS 電視的路徑為「設定 → 支援 → 關於本電視」（確切路徑因機型年份而異）。假設更新「應該成功」是最常見的出錯環節。
- 進行網絡分段，但視之為過渡措施。 將顯示屏置於專屬 VLAN 或隔離的 AV 網絡，是合理的縱深防禦（defence in depth）並可爭取時間，但不能取代修補工作。共享辦公室的 VLAN 設計往往仍容許裝置之間互通，而且分段本身亦會隨網絡政策變更而逐漸失效。
- 重新評估顯示屏所獲取的信任程度。 智能電視日益用來執行應用程式、儲存憑證，並在無人覆核下靜靜連接網絡多年。它們應納入資產清冊，並作為不受信任的終端設備處理——而非當作傢俬。
這並非智能電視廠商首次被發現出貨可從本地網絡觸發的預驗證漏洞。Samsung 的 Tizen 平台先前已有研究詳述其應用商店及 IPTV 組件中可遠端利用的漏洞，Android TV 裝置亦曾因除錯介面及毋須用家互動即可提權的途徑而受到關注。此模式一貫如是——客廳硬件承受著一部小型伺服器級別的網絡暴露風險，而更新習慣卻往往更接近家電產品——不過此處所指的是模式相似，而非嚴重程度相若。
完整技術細節可參閱 SSD Secure Disclosure 的通告。負責共享或半公眾環境顯示屏的機構，應將運行 webOS 7.5.7-25 的電視列入即時修補範圍，並持續留意通告是否會擴大型號清單及可能的 CVE 編號分配。