LG webOS Flaws Let Remote Attackers Execute Commands as Root Without Authentication
Four LG webOS flaws can bypass pairing and run commands as root on exposed smart TVs.
Bitdefender disclosed four LG webOS flaws, CVE-2023-6317 through CVE-2023-6320, affecting selected TVs on webOS 4 through 7. CVE-2023-6317 lets an attacker skip ThinQ PIN pairing and create a privileged account by reusing a client key. CVE-2023-6318 and CVE-2023-6319 are command-injection bugs, and CVE-2023-6320 can run commands as the near-root dbus account. Researchers found more than 91,000 exposed devices on Shodan; LG fixed the issues before the April 2024 publication. The article does not report observed exploitation.
- CVE-2023-6317 through CVE-2023-6320 affect selected webOS 4 through 7 TVs.
- Auth bypass skips the ThinQ PIN and creates a privileged account.
- Command injection can run OS commands, including near-root via dbus.
- Shodan showed over 91,000 exposed devices; LG patched before the April 2024 disclosure.
- Vendors
- LG
- Organizations
- Bitdefender
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2023-6317+3 related CVEs | A prompt bypass exists in the secondscreen.gateway service running on webOS version 4 through 7 | 9.8 group max | 1% | PoC |
From the original article
3 min read at cybersecuritynews.com
Security researchers have disclosed four serious vulnerabilities in LG webOS smart TVs that could allow an attacker to bypass authentication, create a privileged account, and ultimately execute commands with root-level access. The flaws, tracked as CVE-2023-6317 through CVE-2023-6320, affect selected LG TV models running webOS versions 4 through 7. Bitdefender researchers said the issue could […]
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.