Four vulnerabilities in LG's webOS TV platform let researchers skip a PIN prompt and walk straight to root access. Here's what was actually verified, what it took to exploit, and what's still murky.

Most people don't think of their TV as a computer on the network. It is one — and in April 2024, Romanian security firm Bitdefender published research showing exactly why that matters for LG's webOS smart TVs. Four separate flaws, chained together, let an attacker skip the TV's PIN check entirely and end up with root-equivalent control over the device.

None of this happened remotely against a random person's living room out of nowhere. It required either LAN access or an internet-exposed instance of the vulnerable service. But Bitdefender found that more than 91,000 devices were reachable that way, which is a lot more than "no one will ever hit this."[1]

What happened

Bitdefender runs an ongoing IoT research program auditing popular smart-home hardware, and LG's webOS TV operating system was one of the targets. The researchers found several issues affecting webOS versions 4 through 7 running on LG TVs, and they were able to use these issues to gain root access on the TV after bypassing the authorization mechanism.[1] The findings were reported to LG, sat through a patch cycle, and were disclosed publicly once fixes were available.

The four vulnerabilities are tracked as CVE-2023-6317, CVE-2023-6318, CVE-2023-6319, and CVE-2023-6320. The Hacker News reported that the flaws impact webOS 4.9.7 through 5.30.40 on model LG43UM7000PLA, webOS 5.5.0 through 04.50.51 on OLED55CXPUA, webOS 6.3.3-442 through 03.36.50 on OLED48C1PUB, and webOS 7.3.1-43 through 03.33.85 on OLED55A23LA.[2] LG shipped the fix on March 22, 2024, roughly four and a half months after Bitdefender's initial report.

How the bypass worked

webOS runs a service on ports 3000 and 3001 that the LG ThinkQ smartphone app uses to control the TV. Under normal circumstances, pairing the app requires the user to type a PIN that's displayed on screen. That's the whole security model for this feature — a physical, in-room confirmation step.

Bitdefender found an error in the account handler. According to their technical writeup, a variable called skipPrompt gets set to true whenever a request's client-key or companion-client-key parameter matches an existing account — but the server never actually checks that the key belongs to the account making the new request.[1] So the attack goes like this: request an unprivileged account first, note the key it's handed back, then request a second account with elevated permissions while reusing that same key value in the companion-client-key field. The server sees a matching key, decides no PIN confirmation is needed, and creates the privileged account without ever prompting anyone on the TV screen.

That's CVE-2023-6317, confirmed against all four webOS versions Bitdefender tested. It's not itself a takeover — it's a door. What you do once you're through it is where things get worse.

What this actually enabled

With an unauthorized privileged account in hand, Bitdefender's researchers found three separate command-injection paths reachable from that access level.

CVE-2023-6318 lives in the processAnalyticsReport method of the com.webos.service.cloudupload service. It passes a file-path parameter into a system command without sanitizing it. The method can't be called directly, but the researchers found they could reach it indirectly through a notification endpoint's onclose callback — a pattern with a similar shape to server-side request forgery, using one legitimate feature to reach another that isn't supposed to be directly exposed. Bitdefender confirmed this affected webOS 5.5.0, 6.3.3-442, and 7.3.1-43 — notably, not 4.9.7.[1]

CVE-2023-6319 is arguably the strangest of the four: command injection through the code responsible for displaying song lyrics. If a media file's matching lyrics file is encoded a specific way, the TV runs it through a system binary called iconv without sanitizing the filename first, and that filename can carry an injected command. This one hit all four tested webOS versions.

CVE-2023-6320 goes through a network-configuration endpoint, setVlanStaticAddress, which passes IP address and netmask values straight into a system command. Commands executed this way run as the dbus user — which, per Bitdefender's report, carries permissions functionally equivalent to root. This one was confirmed on webOS 5.5.0 and 6.3.3-442 only.

Put together: an attacker with no prior credentials could reach a network-exposed TV, mint themselves a privileged account without touching the remote or the on-screen PIN prompt, and from there run arbitrary commands with root-equivalent permissions. The Hacker News summarized the chaining directly: elevated access from the first flaw combines with CVE-2023-6318 and CVE-2023-6319 to reach root, or with CVE-2023-6320 to execute as the dbus user.[2]

Affected versions and severity

A note on precision here, because it matters: Bitdefender's own advisory does not publish CVSS scores for these four CVEs, and the CVE.org record for this batch wasn't renderable through standard tooling during this research pass — the page requires JavaScript to display content. Rather than borrow a severity number from somewhere else or estimate one, this article isn't stating a CVSS score, version, or vector for CVE-2023-6317 through 6320. If you need the authoritative figure, check the record directly on CVE.org or NVD.

What is verified is the practical impact: root or root-equivalent command execution, triggered without user interaction, on a device most people never think to patch. That's serious regardless of what number ends up attached to it.

CVE	What it does	Confirmed webOS versions
CVE-2023-6317	Bypasses PIN check, creates privileged account	4.9.7, 5.5.0, 6.3.3-442, 7.3.1-43
CVE-2023-6318	Command injection via cloudupload service → root	5.5.0, 6.3.3-442, 7.3.1-43
CVE-2023-6319	Command injection via lyrics-decoding library	4.9.7, 5.5.0, 6.3.3-442, 7.3.1-43
CVE-2023-6320	Command injection via network endpoint → dbus/root-equivalent	5.5.0, 6.3.3-442

Exploitation status

To be clear about terminology: this is a disclosed vulnerability with a working proof of concept produced by the researchers who found it, not a reported case of active exploitation. Nothing in Bitdefender's report, The Hacker News' coverage, or the corroborating reporting from BleepingComputer and SecurityAffairs claims these flaws were exploited in the wild before or after disclosure. There's also no indication these CVEs are listed in CISA's Known Exploited Vulnerabilities catalog — that status wasn't independently verified for this article and shouldn't be assumed either way without checking CISA's list directly.

What raises the risk isn't confirmed exploitation, it's exposure. The vulnerable service is meant for LAN-only use — the TV shouldn't be answering these requests from the open internet at all. But a Shodan scan Bitdefender ran turned up more than 91,000 devices exposing the service to the internet anyway, mostly in South Korea, Hong Kong, the U.S., Sweden, Finland, and Latvia.[1] That's a configuration or ISP-networking problem sitting on top of a software problem — and it's the piece that turns "theoretically exploitable on your LAN" into "actually reachable by anyone scanning the internet."

Who should act

If you own an LG TV running webOS 4 through 7, the fix is a firmware update, and LG released one for the affected versions on March 22, 2024. If your TV auto-updates, it likely already has it. If not, LG's support site has manual update instructions, and BleepingComputer noted the update can be checked directly from Settings → Support → Software Update on the TV itself.[3]

What defenders should do

• Update webOS. Check for and apply the firmware update; turn on automatic updates going forward.
• Segment the network. Put smart TVs and other IoT gear on a guest network or a separate VLAN from laptops, phones, and anything holding sensitive accounts. This is the single biggest structural fix — it limits what a compromised TV can actually reach, regardless of which specific flaw eventually gets found next.
• Check for internet exposure. Home routers shouldn't be forwarding webOS's control ports (3000/3001) to the internet. If you've done custom port forwarding on your router, verify the TV isn't on that list.
• Don't assume "smart TV" means "low risk." A compromised TV sitting on the same network as your laptop is a pivot point, not just an inconvenience.

Security takeaway

None of the four individual bugs here is exotic. A key-reuse authorization flaw, three unsanitized-input command injections — these are old, familiar bug classes. What made the research notable is the chain: stack four ordinary flaws in the right order and you get root access without a single user click. That's a pattern worth remembering for IoT devices generally, not just this one TV lineup. The device doesn't have to be sophisticated to be a real risk; it just has to be reachable and imperfectly checked.

It's also worth sitting with the exposure number for a second. Ninety-one thousand devices weren't vulnerable because of some novel zero-day nobody could have anticipated — they were vulnerable because a LAN-only service ended up facing the internet, which is a configuration issue as much as a software one. Patch the TV. But also take a look at what else on your home network might be answering requests it was never supposed to get from outside.

Sources & References

• [1] Bitdefender Labs — Vulnerabilities Identified in LG WebOS — April 9, 2024 — Original advisory
• [2] The Hacker News (Ravie Lakshmanan) — Researchers Discover LG Smart TV Vulnerabilities Allowing Root Access — April 9, 2024 — View source
• [3] BleepingComputer — Over 90,000 LG Smart TVs May Be Exposed to Remote Attacks — April 2024 — View source
• [4] SecurityAffairs (Pierluigi Paganini) — Over 91,000 LG smart TVs running webOS are vulnerable to hacking — April 9, 2024 — View source
• [5] CVE.org — CVE-2023-6317, CVE-2023-6318, CVE-2023-6319, CVE-2023-6320 record identifiers — CVE.org record
• [6] LG Support — Software and firmware update instructions — LG software/firmware page

This article describes a disclosed and patched vulnerability. It does not include exploit code, payloads, or step-by-step reproduction instructions beyond what the original researchers published for defensive awareness.