LG webOS smart TVs: three local-network flaws chain to pre-auth root via ThinQ pairing (port 3001), sync-demo test cert and pmlogd command injection — SSD advisory 12 Oct; tested on 32LQ636BPSA and 27TQ600SW (webOS 7.5.7-25 / firmware 04.54.40); no CVEs yet
SSD Secure Disclosure published an advisory on 12 October 2026 covering a three-bug chain on LG webOS smart TVs that lets an attacker on the same local network gain root without a PIN or any owner interaction. The Hacker News summarised the chain on 13 October. Entry is through the ThinQ pairing service on port 3001: the attacker replays a sync-demo app manifest signed with a test certificate the firmware still trusts, and a permission in that manifest makes the pairing service skip the PIN and hand over a privileged key. With the key, the attacker launches the built-in cmp-client app to an attacker-controlled page; the page keeps PalmServiceBridge access and abuses the root-running pmlogd logging service with unchecked shell input. The chain was demonstrated on the 32LQ636BPSA and 27TQ600SW models running webOS 7.5.7-25 (firmware 04.54.40); whether other models or builds are affected is not stated. An anonymous researcher took third place in the LG webOS category at TyphoonPWN 2026 (Seoul, May) with the demo. No CVE identifiers have been assigned, and no exploitation in the wild was reported in the sources used here. LG has issued a firmware fix per SSD. Owners should check for a TV firmware update; no workaround is available if the update cannot be applied. This is separate from Bitdefender's 2024 webOS findings and from an earlier TyphoonPWN path-traversal chain on a different port.
- Product
- LG webOS smart TVs (ThinQ pairing on TCP 3001; sync-demo / cmp-client / pmlogd chain)
- Versions
- Confirmed on 32LQ636BPSA and 27TQ600SW running webOS 7.5.7-25, firmware 04.54.40. Other models/firmware not stated. Fixed by LG firmware update (per SSD); no CVE IDs assigned at disclosure.
- Exploited in Australia?
- unknown
- Patch to
- Install the LG firmware update for your TV model as soon as it is offered (Settings → support / software update). Until then, keep the TV off untrusted local networks and treat guest Wi-Fi / IoT VLANs as hostile; there is no workaround if the update cannot be applied. Enterprises using LG digital-signage or hospitality webOS panels should inventory models and push the vendor build through their MDM or signage fleet tool.
Primary: SSD Secure Disclosure — LG webOS sync-demo preauth RCE / local root chain (12 Oct 2026) · The Hacker News — LG Smart TVs Vulnerable to Pre-Auth Root Takeover From Local Network (13 Oct 2026)