Loading vulnerability…
Root command injection in LG webOS audio metadata processing
CVE-2023-6319 is an authenticated operating system command injection vulnerability in the getAudioMetadata method of the LG webOS com.webos.service.attachedstoragemanager service. During lyrics processing, an unsanitized filename is passed to the iconv utility. A matching MP3 audio file and lyrics file beginning with a specific encoding marker trigger the vulnerable processing path. Specially crafted requests can consequently execute commands as root. The vulnerability affects webOS versions 4 through 7 and was confirmed on builds 4.9.7, 5.5.0, 6.3.3-442, and 7.3.1-43.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits operating system command execution as root, compromising the affected television. Device takeover can enable changes to settings, installation of unwanted software, and use of the television as a network foothold. Although this vulnerability requires authenticated access, chaining it with the CVE-2023-6317 authorization bypass permits an attacker to obtain a privileged account without the owner's pairing approval.
If you can’t patch tonight, do this now.
Avoid exposing the television's control service directly to the internet, including through router port forwarding. Isolate smart TVs on a separate guest or IoT network and restrict access from untrusted devices. Keep network routers patched. Network isolation reduces exposure but does not replace installation of the firmware fix.
Patch, then assume compromise.
Install the applicable LG firmware security update. LG released patches for the vulnerabilities on March 22, 2024. Enable automatic updates and manually check for available firmware updates. Exact fixed firmware versions for individual television models are not available in the supplied information.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.