LG webOS Authentication Bypass Enables Root Command Execution on Smart TVs

A reported preauthentication remote code execution chain involving LG webOS’s sync-demo service bypasses client-key issuance, gains service-level access, and culminates in root command execution. Related reporting describes four vulnerabilities, CVE-2023-6317 through CVE-2023-6320, affecting selected LG smart TVs running webOS versions 4 through 7. CVE-2023-6317 bypasses the LG ThinQ pairing PIN and allows creation of a privileged account without the owner’s approval, enabling access to services with command-execution flaws that can provide root-level or near-root privileges. The sync-demo post does not specify affected versions or CVEs, so its exact relationship to those vulnerabilities remains unconfirmed.

Exploitation of the documented vulnerabilities requires network access to the television. Bitdefender historically identified more than 91,000 exposed devices through Shodan, demonstrating potential reach beyond local networks; that figure is not a current exposure count. LG fixed the four vulnerabilities before Bitdefender’s April 2024 public disclosure, despite the renewed reporting in October 2026. The supplied reports provide no evidence of exploitation in the wild. Organizations should verify firmware updates on deployed LG TVs, eliminate direct internet exposure, and isolate smart TVs from sensitive systems.