Loading vulnerability…
Authenticated root command injection in LG webOS analytics reporting
CVE-2023-6318 is an authenticated command injection vulnerability in the processAnalyticsReport method of the LG webOS com.webos.service.cloudupload service, affecting webOS versions 5 through 7. When the type parameter is set to analytic, the reportFile parameter is passed to a system command without sanitization. A sequence of crafted requests can invoke the vulnerable method indirectly through notification callbacks and execute operating system commands as root. Confirmed affected configurations include webOS 5.5.0 with firmware 04.50.51 on OLED55CXPUA, webOS 6.3.3-442 with firmware 03.36.50 on OLED48C1PUB, and webOS 7.3.1-43 with firmware 03.33.85 on OLED55A23LA.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation enables operating system command execution as root and full takeover of the affected television. The vulnerability can elevate an attacker's authenticated service access to root-level control. It can also be chained with CVE-2023-6317, which bypasses pairing authorization and creates a privileged account.
If you can’t patch tonight, do this now.
Avoid exposing the television's control service directly to the internet and remove router port forwarding that makes it externally reachable. Place the television on a separate IoT or guest network and restrict access from untrusted devices. Keep the router patched. Network isolation reduces exposure but does not correct the command injection flaw.
Patch, then assume compromise.
Install the applicable LG firmware security update using automatic updates or the television's manual update mechanism. LG released patches on March 22, 2024. Exact fixed firmware versions for the affected models are not available in the supplied information.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.