Loading vulnerability…
Authenticated command injection in LG webOS network configuration
CVE-2023-6320 is an authenticated operating-system command injection vulnerability in the setVlanStaticAddress method of the LG webOS com.webos.service.connectionmanager service. The ip_address, bcast_address, and netmask parameters are passed to a system command without sanitization. Following creation of a virtual LAN, an authenticated attacker with READ_NETWORK_STATE permission can submit specially crafted requests to execute commands as the dbus user. Confirmed affected configurations include webOS 5.5.0, firmware 04.50.51, on OLED55CXPUA televisions and webOS 6.3.3-442 (kisscurl-kinglake), firmware 03.36.50, on OLED48C1PUB televisions.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits operating-system command execution under the dbus account, whose permissions are described as similar to root. This enables privileged manipulation of the affected television, although execution as root itself is not established for this vulnerability. Chaining the flaw with CVE-2023-6317 can provide the privileged authenticated access needed for exploitation without the owner's pairing approval.
If you can’t patch tonight, do this now.
Avoid exposing the television's control service directly to the internet, including through router port forwarding. Restrict network access to trusted devices, place televisions on a separate guest or IoT network where possible, and keep routers patched. Network isolation reduces exposure but does not correct the vulnerable command handling.
Patch, then assume compromise.
Install LG firmware updates addressing CVE-2023-6320. LG released patches for the vulnerability set on March 22, 2024. Enable automatic software updates and manually check for available firmware updates. Exact fixed firmware version numbers for the affected models are not available in the supplied information.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.