LG webOS Flaw Chain Enables Unauthenticated Root Takeover of Smart TVs

Three vulnerabilities in LG webOS can be chained to give an attacker on the same local network root access to certain smart TVs without a pairing PIN or owner interaction. The chain bypasses pairing authentication through sync-demo, uses cmp-client to access privileged system interfaces from an attacker-controlled webpage, and exploits command injection in the root-running pmlogd service. An anonymous researcher demonstrated the attack at TyphoonPWN 2026; testing confirmed it on LG 32LQ636BPSA and 27TQ600SW televisions running webOS 7.5.7-25 with firmware 04.54.40. Exposure of other models and versions remains unknown.

LG has released a firmware fix following SSD Secure Disclosure's October 12 disclosure. Owners and organizations operating LG smart TVs should check for and install available firmware updates; the reports identify no workaround. No CVE identifiers have been assigned, and no exploitation in the wild has been reported.