LG webOS chain grants root access from local network without PIN

Affected Systems

LG smart TVs running webOS 7.5.7-25 on firmware 04.54.40. Confirmed on models 32LQ636BPSA and 27TQ600SW. Other models and firmware versions may be affected but are unconfirmed.

Exploitation Status

Demonstrated at TyphoonPWN 2026 in May by anonymous researcher. No CVE assigned. No exploitation in the wild reported. Proof-of-concept exists but not publicly released.

Business Impact

Attackers on the same local network can achieve unauthenticated root access without user interaction or PIN entry. Attack chain exploits port 3001 pairing service, abuses built-in apps with test certificate trust, and injects commands via pmlogd logging service. No workaround available for devices that cannot update. Risk limited to local network access (guest WiFi, compromised internal hosts, physical proximity). This is the third distinct local network root chain disclosed for LG webOS since 2024.

Urgency

🟡 Within a week

Recommended Actions

• Identify all LG smart TVs in the environment and check firmware versions via device settings or asset inventory.
• Apply LG firmware updates immediately for affected models 32LQ636BPSA and 27TQ600SW running webOS 7.5.7-25 firmware 04.54.40.
• Isolate LG smart TVs on a dedicated VLAN with no access to sensitive internal networks or systems.
• Block inbound traffic to TCP port 3001 on LG TVs from untrusted network segments using firewall or ACL rules.
• Disable LG ThinQ app pairing functionality if remote control via mobile app is not required for business use.