- ssd-disclosure.com reports a chain of three flaws in LG webOS that gave root control on a tested TV, running firmware 04.54.40.
- Each step trusted the last: a replayable signed test manifest, an unchecked web address, then a shell command run as root.
- LG has issued a fix. Inventory your LG TVs, confirm their firmware against LG's bulletin and keep them off sensitive networks.
A valid signature is not the same as permission
A signature proves who wrote a file. It does not prove the file should be accepted today, from this sender, on this device. A concert ticket stamped by the box office is genuine. It still should not let a stranger in after the show.
That gap sits at the centre of a new report from ssd-disclosure.com on LG's webOS smart TV software. An independent researcher chained three weaknesses into full control of a TV. The researcher took third place in the LG webOS category at TyphoonPWN 2026.
LG has issued a fix. The report points to the LG security bulletin page. The text we reviewed does not say which firmware version carries the fix.
How the chain works
The report describes three steps. Each one hands the attacker a little more trust than the one before.
Step one is pairing. A TV app named sync-demo ships with a manifest signed by LG. A manifest is a file that lists what a connecting client may do. The attacker replays that signed file to the TV's pairing service, called SSG.
SSG checks the signature against a certificate. On the tested firmware, SSG trusted a certificate named test-signing-cert.pem. The signed permissions were then copied into a new client profile.
One permission in the file is called STB_INTERNAL_CONNECTION. It tells SSG to skip the pairing prompt. The TV therefore issued a client-key with no PIN entered. The researcher says this works because the signed manifest is already on the device image.
Step two is a web address that nobody checks. An app called cmp-client reads an address named interactiveUrl from its launch parameters. It treats a successful HEAD response, a basic check that the page exists, as enough validation. The app does not limit which kinds of address, which hosts or which origins it will accept, the report says.
The TV then loads the attacker's page inside the same app. That page keeps access to PalmServiceBridge, the link to webOS's internal services. cmp-client is a trusted app with broad permissions. The attacker's page can therefore call internal methods that the original client could not reach directly.
Step three is a command smuggled into a request field. A logging service called pmlogd has a method named collectAllLog. It builds shell commands from two request fields, targetDir and targetFile. Shell metacharacters in targetDir become part of the command. The service runs as root, so the injected command runs as root too.
The lesson: trust that compounds
None of these steps looks dramatic alone. A test certificate is trusted. A web address is loosely checked. A folder-name field in a logging request is passed to a shell. Chained together, they turn a pairing request into total control.
This shows how modern devices fail. Security rarely rests on one lock. It rests on a sequence of components, each assuming the one before it did the checking. When every link assumes that, nobody checks.
The report's fix list reflects this. It calls for removing the hardcoded signed manifest and for no longer trusting the test certificate for remote pairing. It also asks for validation of interactiveUrl, and for keeping the internal bridge away from externally loaded pages. Finally, it says to stop passing text to a shell. That is one repair for each link.
What the report does and does not show
The researcher tested one firmware build. The report does not say how many other LG models or versions behave the same way. Treat that as an open question for LG and your supplier.
The proof-of-concept is run with the TV's IP address and the attacker's LAN IP address. That suggests the attacker needs a network path to the TV. The report does not describe attacks in the wild.
The text we reviewed also gives no CVE identifier. Check the LG bulletin for any assigned IDs.
Questions for your team
Smart TVs sit in boardrooms, lobbies, training rooms and guest areas. In many organisations they go missing from the asset lists that security teams patch from. A flaw like this is a chance to test whether yours are on the list.
Ask your IT lead these questions this week. First, do we know how many LG webOS TVs we run, and where? Second, have they been updated to the firmware named in LG's security bulletin? Third, do they share a network with laptops, file servers or payment systems, or are they separated?
Then ask suppliers a broader question. Do your production builds ship test signing certificates or sample apps? If an answer is vague, that is a finding in itself.
A screen on the wall is a networked computer with an operating system. It needs an owner, an update schedule and a place on the network that limits the damage if it is taken over.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: ssd-disclosure.com.
