Flaws in 90,000+ LG WebOS TVs Let Attacker’s Completely take Over Devices

Bitdefender, the cybersecurity firm, has unveiled a series of critical vulnerabilities in LG’s WebOS TVs, affecting over 91,000 devices worldwide.

These flaws, identified as CVE-2023-6317, CVE-2023-6318, CVE-2023-6319, and CVE-2023-6320, could allow attackers to gain unauthorized root access, posing risks to users’ privacy and security.

Bitdefender, renowned for creating the world’s first smart home cybersecurity hub, conducted this research as part of its ongoing efforts to enhance IoT security.

The vulnerabilities were discovered in an audit of LG TVs running WebOS versions 4 through 7, revealing a critical oversight in the devices’ security mechanisms.

CVE-2023-6317: Bypassing Authorization

The first in the series, CVE-2023-6317, allows attackers to bypass the authorization mechanism in WebOS versions 4 through 7.

By manipulating a specific variable, attackers can add an extra user to the TV set, sidestepping the intended security measures.

This vulnerability is particularly concerning as it lays the groundwork for further exploitation.

CVE-2023-6318: Root Access

Following the initial breach, CVE-2023-6318 enables attackers to elevate their root access, granting them full control over the device.

This vulnerability is executed through authenticated command injection in the processAnalyticsReport method from the com.webos.service.cloud upload service.

By exploiting this flaw, attackers can execute arbitrary commands with the highest privileges.

CVE-2023-6319: OS Command Injection

CVE-2023-6319 introduces another layer of threat by allowing operating system command injection.

This flaw is found in the getAudioMetadata method from the com.webos.service.attached storage manager service, where manipulated music lyrics files can lead to unauthorized command execution.

This vulnerability underscores the diverse methods attackers can employ to infiltrate the system.

CVE-2023-6320: Authenticated Command Injection

The final vulnerability, CVE-2023-6319, permits attackers to inject authenticated commands by exploiting the com.webos.service.connectionmanager/tv/setVlanStaticAddress API endpoint.

This flaw enables the execution of commands on the device as the dbus user, who possesses permissions to the root user, further compounding the potential for exploitation.

Vulnerable OS Versions

The vulnerabilities affect a range of WebOS versions and models, including but not limited to:

• webOS 4.9.7 – 5.30.40 running on LG43UM7000PLA
• webOS 5.5.0 – 04.50.51 running on OLED55CXPUA
• webOS 6.3.3-442 (kisscurl-kinglake) – 03.36.50 running on OLED48C1PUB
• webOS 7.3.1-43 (mullet-mebin) – 03.33.85 running on OLED55A23LA

The report provides a detailed technical analysis of how the vulnerabilities were exploited.

For instance, an error in the account handler allows attackers to skip PIN verification entirely, creating a privileged user profile without user interaction.

This and other technical insights into the vulnerabilities underscore the critical need for robust security measures in IoT devices.

The discovery of these vulnerabilities in LG WebOS TVs highlights the ongoing challenges in securing smart devices.

Users are urged to update their devices as soon as possible to mitigate the risks posed by these flaws.

Bitdefender’s report serves as a crucial reminder of the importance of cybersecurity in the ever-expanding IoT landscape.

Secure your emails in a heartbeat! To find your ideal email security vendor, Take a Free 30-Second Assessment.