TechCapsules

AI-summarised brief · reviewed before publication

Three flaws in LG’s webOS can be chained to let a LAN attacker obtain root on certain smart TVs without a PIN or user interaction. The exploit uses the service on port 3001 that the LG ThinQ app accesses, replays a signed manifest from the sync‑demo app, and forces the pairing service to skip its PIN prompt. With the privileged key the attacker launches the cmp‑client app, redirects it to a malicious page, and uses PalmServiceBridge to invoke the root‑run pmlogd logging service, which runs shell commands. LG issued a firmware update for webOS 7.5.7‑25 (04.54.40) on October 12, covering models 32LQ636BPSA and 27TQ600SW; impact on other devices is unknown. No workaround exists and no CVE IDs or wild exploits have been reported.