More than 91,000 LG TVs with webOS are vulnerable to hacking.

Researchers have discovered several vulnerabilities in LG webOS, running on smart TVs, that could allow attackers to gain root access to the devices. Researchers from Bitdefender found multiple vulnerabilities in LG webOS, which operates on smart TVs, that can be exploited to bypass authentication and obtain root access to the devices. The identified vulnerabilities affect webOS versions 4 through 7, running on LG TVs.

According to the message:

“WebOS launches a service on ports 3000/3001 (HTTP/HTTPS/WSS), which is used by the LG ThinkQ app on smartphones to control the TV.

Sale flat in Southbury 192 212 $

USA,Southbury

3 Bedrooms

2 Bathrooms

106 м²

Sale house in Chicago with city view 299 000 $

USA,Chicago

4 Bedrooms

1 Bathroom

107 м²

Sale flat in Chicago with city view 219 999 $

USA,Chicago

2 Bedrooms

2 Bathrooms

133 м²

Sale flat in New York with city view 625 000 $

USA,New York

1 Bedroom

1 Bathroom

78 м²

Sale flat in Fort Lauderdale 595 000 $

USA,Fort Lauderdale

1 Bedroom

1 Bathroom

63 м²

Sale cottage in Houston with park view 550 000 $

USA,Houston

4 Bedrooms

3 Bathrooms

258 м²

To set up the app, the user needs to enter a PIN code on the TV screen.” “A flaw in the account handler allows an attacker to completely bypass the PIN verification and create a privileged user profile.”

Researchers noted that despite the fact that the vulnerable service is intended only for access to the LAN, a query in Shodan revealed over 91,000 devices that provide access to this service over the internet. Currently, the number of vulnerable devices has decreased to 88,000. Most of the devices accessing the internet are located in South Korea, Hong Kong, the USA, Sweden, and Finland.

List of vulnerabilities:

CVE-2023-6317- Problem of bypassing authentication
CVE-2023-6318- Privilege escalation issue
CVE-2023-6319- A vulnerability that allows the injection of operating system commands
CVE-2023-6320- A vulnerability that allows the insertion of authenticated commands

Vulnerabilities affect the following versions of webOS: webOS 4.9.7 - 5.30.40, webOS 5.5.0 - 04.50.51, webOS 6.3.3-442 (kisscurl-kinglake) - 03.36.50, webOS 7.3.1-43 (mullet-mebin) - 03.33.85.