Loading vulnerability…
LG webOS secondscreen.gateway pairing authentication bypass
CVE-2023-6317 is an authentication bypass in the secondscreen.gateway service on LG smart TVs running webOS versions 4 through 7. The LG ThinQ account-registration and pairing flow improperly validates client-key and companion-client-key values when deciding whether to require PIN verification. An attacker can create an account without permissions, then reuse its key to register a second account with elevated permissions without the television owner's approval. The server checks that the key exists but does not correctly associate it with the account being created. Confirmed affected configurations include webOS 4.9.7 with firmware 5.30.40 on LG43UM7000PLA, webOS 5.5.0 with firmware 04.50.51 on OLED55CXPUA, webOS 6.3.3-442 with firmware 03.36.50 on OLED48C1PUB, and webOS 7.3.1-43 with firmware 03.33.85 on OLED55A23LA.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation bypasses the pairing authorization boundary and creates a privileged account with access to services unavailable to unauthenticated users. This access can enable subsequent exploitation of separate authenticated command-injection vulnerabilities, including CVE-2023-6318, CVE-2023-6319, and CVE-2023-6320, on applicable builds. Root or near-root command execution is an outcome of chaining those vulnerabilities, not a demonstrated direct effect of CVE-2023-6317 alone.
If you can’t patch tonight, do this now.
Avoid router port forwarding or other configurations that expose the television's control service directly to the internet. Place the television on a separate guest or IoT network isolated from sensitive devices, and keep the router patched. Network isolation reduces exposure but does not correct the pairing authentication flaw.
Patch, then assume compromise.
Install the applicable LG firmware security update. LG released patches on March 22, 2024, before public disclosure on April 9, 2024. Enable automatic software updates and manually verify that the television has received the latest firmware available for its model. Exact minimum fixed firmware versions are not available in the supplied information.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.