Bitdefender researchers disclose four LG webOS flaws enabling root access
Security experts revealed four vulnerabilities in LG smart TVs that allow remote attackers to bypass authentication and execute commands as root.
Key points
- Four flaws, CVE-2023-6317 through CVE-2023-6320, affect LG webOS versions 4 through 7.
- Attackers can bypass PIN verification to create privileged accounts and run OS commands.
- Bitdefender confirmed LG fixed these issues before the April 2024 public disclosure.
Security researchers from Bitdefender disclosed four serious vulnerabilities in LG webOS smart TVs that enable remote attackers to execute commands with root-level access without proper authentication. The flaws, tracked as CVE-2023-6317 through CVE-2023-6320, allow adversaries to bypass security controls and gain full control of vulnerable devices.
The most significant issue, CVE-2023-6317, compromises the pairing process used by the LG ThinQ mobile application. By exploiting a weakness in the account-registration logic, attackers can skip the required on-screen PIN verification. This allows them to create user profiles with elevated permissions, granting access to services normally restricted to authenticated users.
Technical Context and Attack Chain
Bitdefender researchers explained that the vulnerability stems from how the system handles client-key and companion-client-key values during registration. An attacker can request a low-permission account, obtain its associated key, and then reuse that key when requesting a higher-permission account. The TV verifies the key’s existence but fails to confirm it belongs to the specific account being created, thus bypassing the PIN prompt.
Once a privileged account is established, attackers can leverage the remaining three flaws to execute operating system commands. CVE-2023-6318 and CVE-2023-6319 are command-injection vulnerabilities that allow direct execution of OS commands. CVE-2023-6320 affects a network configuration endpoint, enabling command execution under the dbus account, which holds permissions close to root access.
Affected Devices and Exposure Scope
These vulnerabilities impact selected LG TV models running webOS versions 4 through 7. Bitdefender confirmed the presence of these flaws on several specific builds, including webOS 4.9.7, 5.5.0, 6.3.3-442, and 7.3.1-43. The research indicates that while the primary risk exists on the local network, internet exposure significantly widens the attack surface for potential adversaries.
According to Cyber Security News, researchers identified more than 91,000 exposed LG devices via Shodan, a search engine that indexes internet-connected services. This data highlights how local-network weaknesses can become widespread concerns when devices are improperly exposed to the public internet, turning a local vulnerability into a remote exploit vector.
What should you do?
Bitdefender stated that LG fixed the reported issues before the research was publicly released in April 2024. Users should verify that their devices are running the latest available firmware updates to ensure these patches are applied. Checking for software updates is the primary method for mitigating these specific authentication and command-injection risks on affected hardware.
What to do and how to stay safe: LG
- Check your LG TV's software version and install any available updates to apply the vendor's security patches.
- Review your router settings to ensure your smart TV is not directly accessible from the public internet.
- Use a strong, unique password for your LG account to reduce the risk of unauthorized access attempts.
- Monitor network traffic for unusual activity that might indicate an attacker is attempting to pair with your device.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which LG webOS versions are affected by these vulnerabilities?
The flaws affect selected LG TV models running webOS versions 4 through 7, including builds 4.9.7, 5.5.0, 6.3.3-442, and 7.3.1-43.
How many devices were exposed to the internet?
Researchers found more than 91,000 exposed devices through Shodan, according to Bitdefender and Cyber Security News.
Has LG released a fix for these issues?
Yes, Bitdefender confirmed that LG fixed the reported issues before the public release of the research in April 2024.
