LG Smart TV Flaws Let Anyone on Your Wi-Fi Take Full Control, No PIN Needed

Researchers have shown that three vulnerabilities in LG's webOS can be chained together to give an attacker on the same local network full (root) access to certain smart TVs. The attacker needs no PIN and no action from the owner. According to an advisory published by SSD Secure Disclosure on October 12, LG has issued a fix.

The chain was tested on two models, the 32LQ636BPSA and the 27TQ600SW, running webOS 7.5.7-25 on firmware 04.54.40. It is not known whether other models or firmware versions are affected. The attack starts with a pairing service the TV exposes for the LG ThinQ app. It abuses built-in apps and a trusted test certificate to bypass the PIN prompt, then reaches internal system services that run with the highest privileges. No workaround exists for owners who cannot update yet.

This is not the first such case. In 2024, Bitdefender disclosed different webOS flaws that allowed unauthenticated network access, and these were patched in March 2024. A separate chain shown at TyphoonPWN 2025 used a different port. The latest chain was demonstrated by an anonymous researcher who placed third in the LG webOS category at TyphoonPWN 2026 in Seoul in May. No CVE identifiers have been assigned, and no exploitation in the wild has been reported.