Tuesday, October 15, 2024
Homecyber securityFlaws in 90,000+ LG WebOS TVs Let Attacker’s Completely take Over Devices

Flaws in 90,000+ LG WebOS TVs Let Attacker’s Completely take Over Devices

Published on

Malware protection

Bitdefender, the cybersecurity firm, has unveiled a series of critical vulnerabilities in LG’s WebOS TVs, affecting over 91,000 devices worldwide.

These flaws, identified as CVE-2023-6317, CVE-2023-6318, CVE-2023-6319, and CVE-2023-6320, could allow attackers to gain unauthorized root access, posing risks to users’ privacy and security.

Bitdefender, renowned for creating the world’s first smart home cybersecurity hub, conducted this research as part of its ongoing efforts to enhance IoT security.

- Advertisement - SIEM as a Service

The vulnerabilities were discovered in an audit of LG TVs running WebOS versions 4 through 7, revealing a critical oversight in the devices’ security mechanisms.

CVE-2023-6317: Bypassing Authorization

The first in the series, CVE-2023-6317, allows attackers to bypass the authorization mechanism in WebOS versions 4 through 7.

Document
Stop Advanced Phishing Attack With AI

AI-Powered Protection for Business Email Security

Trustifi’s Advanced threat protection prevents the widest spectrum of sophisticated attacks before they reach a user’s mailbox. Stopping 99% of phishing attacks missed by other email security solutions. .

By manipulating a specific variable, attackers can add an extra user to the TV set, sidestepping the intended security measures.

This vulnerability is particularly concerning as it lays the groundwork for further exploitation.

CVE-2023-6318: Root Access

Following the initial breach, CVE-2023-6318 enables attackers to elevate their root access, granting them full control over the device.

This vulnerability is executed through authenticated command injection in the processAnalyticsReport method from the com.webos.service.cloud upload service.

By exploiting this flaw, attackers can execute arbitrary commands with the highest privileges.

CVE-2023-6319: OS Command Injection

CVE-2023-6319 introduces another layer of threat by allowing operating system command injection.

This flaw is found in the getAudioMetadata method from the com.webos.service.attached storage manager service, where manipulated music lyrics files can lead to unauthorized command execution.

This vulnerability underscores the diverse methods attackers can employ to infiltrate the system.

CVE-2023-6320: Authenticated Command Injection

The final vulnerability, CVE-2023-6319, permits attackers to inject authenticated commands by exploiting the com.webos.service.connectionmanager/tv/setVlanStaticAddress API endpoint.

This flaw enables the execution of commands on the device as the dbus user, who possesses permissions to the root user, further compounding the potential for exploitation.

Vulnerable OS Versions

The vulnerabilities affect a range of WebOS versions and models, including but not limited to:

  • webOS 4.9.7 – 5.30.40 running on LG43UM7000PLA
  • webOS 5.5.0 – 04.50.51 running on OLED55CXPUA
  • webOS 6.3.3-442 (kisscurl-kinglake) – 03.36.50 running on OLED48C1PUB
  • webOS 7.3.1-43 (mullet-mebin) – 03.33.85 running on OLED55A23LA

The report provides a detailed technical analysis of how the vulnerabilities were exploited.

For instance, an error in the account handler allows attackers to skip PIN verification entirely, creating a privileged user profile without user interaction.

This and other technical insights into the vulnerabilities underscore the critical need for robust security measures in IoT devices.

The discovery of these vulnerabilities in LG WebOS TVs highlights the ongoing challenges in securing smart devices.

Users are urged to update their devices as soon as possible to mitigate the risks posed by these flaws.

Bitdefender’s report serves as a crucial reminder of the importance of cybersecurity in the ever-expanding IoT landscape.

Secure your emails in a heartbeat! To find your ideal email security vendor, Take a Free 30-Second Assessment.

Divya
Divya
Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Latest articles

HORUS Protector Delivering AgentTesla, Remcos, Snake, NjRat Malware

The Horus Protector crypter is being used to distribute various malware families, including AgentTesla,...

ErrorFather Hackers Attacking & Control Android Device Remotely

The Cerberus Android banking trojan, which gained notoriety in 2019 for its ability to...

Hackers Allegedly Selling Data Stolen from Cisco

A group of hackers reportedly sells sensitive data stolen from Cisco Systems, Inc.The...

Fortigate SSLVPN Vulnerability Exploited in the Wild

A critical vulnerability in Fortinet's FortiGate SSLVPN appliances, CVE-2024-23113, has been actively exploited in...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

HORUS Protector Delivering AgentTesla, Remcos, Snake, NjRat Malware

The Horus Protector crypter is being used to distribute various malware families, including AgentTesla,...

ErrorFather Hackers Attacking & Control Android Device Remotely

The Cerberus Android banking trojan, which gained notoriety in 2019 for its ability to...

Hackers Allegedly Selling Data Stolen from Cisco

A group of hackers reportedly sells sensitive data stolen from Cisco Systems, Inc.The...