Anyone connected to the same home network as a certain LG television could take complete control of the set, with no PIN entered and no action from its owner. An unnamed researcher who placed third in the LG webOS category at TyphoonPWN 2026 in Seoul chained three flaws to reach the highest privilege level on the device, and LG has since issued a firmware fix.
Free daily tech newsletter: TLDR is the free daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.
We may earn a commission if you sign up.
The tested sets were the LG 32LQ636BPSA and the 27TQ600SW, both running webOS 7.5.7-25 on firmware 04.54.40. The advisory went public on Oct. 12, 2026, and The Hacker News reported it the next day. No CVE identifiers have been assigned to the three weaknesses, no exploitation in the wild has been reported, and which other models and firmware builds share the problem has not been established. Owners of other LG sets therefore cannot rule themselves out from the published material alone.
Port 3001 and the ThinQ pairing service
The way in is a service listening on port 3001, which the LG ThinQ phone app uses to pair with a television. Pairing normally depends on a PIN shown on the screen, a step meant to prove that whoever is linking a phone to the set is actually in the room. According to the Hacker News report by Swati Khandelwal, the researcher found that this step can be skipped entirely. The attacker replays a manifest from sync-demo, an app built into the firmware, which was signed with a test certificate that the television still trusts. A permission carried inside that manifest instructs the pairing service to bypass the PIN prompt and hand over a privileged key.
Reaching that port requires nothing more than membership of the same local network. Any device that has joined the household Wi-Fi, whether a visitor’s phone or a laptop that has picked up malware, sits in a position to try the attack, which is why the network boundary matters so much more than the television’s own password habits.
From a test certificate to a root shell
With the privileged key in hand, the attacker launches cmp-client, another app that ships with the set, and points it at a page the attacker controls. The app does not check where it has been told to navigate. The loaded page keeps access to PalmServiceBridge, an internal interface to the television’s system services. Through that bridge the attacker calls pmlogd, a logging service, and injects shell commands into an input field that is never validated. Because pmlogd runs as root, whatever is injected runs as root, the most powerful account on the device and the one that can read, change or replace nearly anything stored on it.
Each link in the chain looks modest on its own: a trusted test certificate, a missing navigation check, an unvalidated text field. Chained, they remove every barrier between a network neighbor and full control of the set.
This is not the first time webOS has been picked apart through services that listen on the local network. Bitdefender researchers disclosed a different set of LG webOS flaws allowing unauthenticated network access that LG patched in March 2024. A separate TyphoonPWN 2025 entry described a chain built on path traversal against a different port that also ended in full device takeover. Three research efforts across three years have now reached deep into the same platform through the conveniences that let phones and televisions find each other, and each time the fix has arrived only after the work was made public.
LG’s firmware fix and what owners can do
LG has issued a fix, and the SSD Secure Disclosure advisory points readers to the company’s security bulletin for television updates rather than naming a fixed version itself. Because the published material does not state a version number, owners are better served checking the software update screen on the television than waiting for confirmation of a specific build. The Hacker News reports that no workaround exists for people who cannot update yet, so installing the firmware is the only remedy on offer. Owners who switched off automatic updates will need to check by hand.
The advisory itself, published by SSD Secure Disclosure on Oct. 12, credits the researcher only for the third-place finish at TyphoonPWN 2026 and gives no earlier disclosure dates, so it is not clear how long the flaws were reachable before LG shipped the correction. What is clear is the narrow condition for exploitation: the attacker must already be on the same network. Keeping visitors on a separate guest network and limiting which devices can join the main one are general precautions that reduce that exposure, and neither replaces the update.
For most households the practical risk is modest today, given that no attacks have been reported and the exploit needs proximity on the network. The value of the disclosure lies in the lesson that a television is a networked computer running a full operating system, and that a pairing feature built for convenience can become the weakest door in the house when a test credential is left trusted in shipping firmware.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
More from Morning Overview
- The NSA says three phone features should be off whenever you aren’t using them
- Hurricane Hunter radar shows four warning signs that a tropical cyclone is about to strengthen, a University of Miami study found
- Tropical Storm Rachel is dumping up to 12 inches on four Mexican states on its way to major hurricane strength
- The FTC says Lens.com doubled the price shoppers saw in Google ads
