LG Issues Patch After WebOS Flaw Lets Local Network Attackers Gain Root on Smart TVs

LG Electronics has released a firmware update to address a trio of security flaws in its webOS platform that could allow an unauthenticated user on the same Wi‑Fi network to obtain root privileges on certain Smart TV models.

The vulnerabilities, disclosed in an advisory by the SSD Secure Disclosure program and first reported by The Hacker News, can be combined to bypass the TV's pre‑authentication checks. An attacker who is connected to the same local network as the target TV could exploit the chain without needing the device's PIN or any interaction from the owner, potentially gaining full control over the system.

WebOS, LG's proprietary operating system for its Smart TVs, runs a suite of internet‑connected services and apps. Because these devices are often left on continuously and are accessible to other devices on the home network, a flaw that permits remote code execution without user involvement poses a notable risk. Exploiting the flaws could let an adversary manipulate the TV’s functionality, intercept media streams, or use the compromised hardware as a foothold for further attacks within the network.

LG’s response includes a software patch that closes the identified weaknesses. The company advises users to apply the update as soon as it becomes available through the TV’s automatic update mechanism or via manual installation using the settings menu. Consumers who cannot update immediately are recommended to isolate the TV from other networked devices, for example by placing it on a separate VLAN or disabling network sharing features.

Security researchers note that the chain of three vulnerabilities is relatively uncommon, as attackers typically rely on a single exploit. The fact that they can be linked together to achieve a pre‑authentication root takeover underscores the importance of rigorous code review and timely disclosure processes in the rapidly expanding Internet‑of‑Things market.

Industry observers say the incident highlights broader challenges for manufacturers of connected home appliances. As smart TVs become more integrated with voice assistants, streaming services, and home automation hubs, ensuring robust security controls is essential to protect consumer privacy and prevent devices from being co‑opted into larger botnets. LG’s prompt patch demonstrates a positive step, but analysts caution that ongoing vigilance and regular firmware updates will remain critical for maintaining device security.