Bitdefender, the cybersecurity firm, has unveiled a series of critical vulnerabilities in LG’s WebOS TVs, affecting over 91,000 devices worldwide.
These flaws, identified as CVE-2023-6317, CVE-2023-6318, CVE-2023-6319, and CVE-2023-6320, could allow attackers to gain unauthorized root access, posing risks to users’ privacy and security.
Bitdefender, renowned for creating the world’s first smart home cybersecurity hub, conducted this research as part of its ongoing efforts to enhance IoT security.
The vulnerabilities were discovered in an audit of LG TVs running WebOS versions 4 through 7, revealing a critical oversight in the devices’ security mechanisms.
The first in the series, CVE-2023-6317, allows attackers to bypass the authorization mechanism in WebOS versions 4 through 7.
Trustifi’s Advanced threat protection prevents the widest spectrum of sophisticated attacks before they reach a user’s mailbox. Stopping 99% of phishing attacks missed by other email security solutions. .
By manipulating a specific variable, attackers can add an extra user to the TV set, sidestepping the intended security measures.
This vulnerability is particularly concerning as it lays the groundwork for further exploitation.
Following the initial breach, CVE-2023-6318 enables attackers to elevate their root access, granting them full control over the device.
This vulnerability is executed through authenticated command injection in the processAnalyticsReport method from the com.webos.service.cloud upload service.
By exploiting this flaw, attackers can execute arbitrary commands with the highest privileges.
CVE-2023-6319 introduces another layer of threat by allowing operating system command injection.
This flaw is found in the getAudioMetadata method from the com.webos.service.attached storage manager service, where manipulated music lyrics files can lead to unauthorized command execution.
This vulnerability underscores the diverse methods attackers can employ to infiltrate the system.
The final vulnerability, CVE-2023-6319, permits attackers to inject authenticated commands by exploiting the com.webos.service.connectionmanager/tv/setVlanStaticAddress API endpoint.
This flaw enables the execution of commands on the device as the dbus user, who possesses permissions to the root user, further compounding the potential for exploitation.
The vulnerabilities affect a range of WebOS versions and models, including but not limited to:
The report provides a detailed technical analysis of how the vulnerabilities were exploited.
For instance, an error in the account handler allows attackers to skip PIN verification entirely, creating a privileged user profile without user interaction.
This and other technical insights into the vulnerabilities underscore the critical need for robust security measures in IoT devices.
The discovery of these vulnerabilities in LG WebOS TVs highlights the ongoing challenges in securing smart devices.
Users are urged to update their devices as soon as possible to mitigate the risks posed by these flaws.
Bitdefender’s report serves as a crucial reminder of the importance of cybersecurity in the ever-expanding IoT landscape.
Secure your emails in a heartbeat! To find your ideal email security vendor, Take a Free 30-Second Assessment.
Hackers prefer phishing as it exploits human vulnerabilities rather than technical flaws which make it a highly effective and low-cost…
A very important message from the Norwegian National Cyber Security Centre (NCSC) says that Secure Socket Layer/Transport Layer Security (SSL/TLS)…
Linux is widely used in numerous servers, cloud infrastructure, and Internet of Things devices, which makes it an attractive target…
ViperSoftX malware, known for stealing cryptocurrency information, now leverages Tesseract, an open-source OCR engine, to target infected systems, which extracts…
Santander has confirmed that there was a major data breach that affected its workers and customers in Spain, Uruguay, and…
The U.S. government has offered a prize of up to $5 million for information that leads to the arrest and…