Bitdefender, the cybersecurity firm, has unveiled a series of critical vulnerabilities in LG’s WebOS TVs, affecting over 91,000 devices worldwide.
These flaws, identified as CVE-2023-6317, CVE-2023-6318, CVE-2023-6319, and CVE-2023-6320, could allow attackers to gain unauthorized root access, posing risks to users’ privacy and security.
Bitdefender, renowned for creating the world’s first smart home cybersecurity hub, conducted this research as part of its ongoing efforts to enhance IoT security.
The vulnerabilities were discovered in an audit of LG TVs running WebOS versions 4 through 7, revealing a critical oversight in the devices’ security mechanisms.
The first in the series, CVE-2023-6317, allows attackers to bypass the authorization mechanism in WebOS versions 4 through 7.
Trustifi’s Advanced threat protection prevents the widest spectrum of sophisticated attacks before they reach a user’s mailbox. Stopping 99% of phishing attacks missed by other email security solutions. .
By manipulating a specific variable, attackers can add an extra user to the TV set, sidestepping the intended security measures.
This vulnerability is particularly concerning as it lays the groundwork for further exploitation.
Following the initial breach, CVE-2023-6318 enables attackers to elevate their root access, granting them full control over the device.
This vulnerability is executed through authenticated command injection in the processAnalyticsReport method from the com.webos.service.cloud upload service.
By exploiting this flaw, attackers can execute arbitrary commands with the highest privileges.
CVE-2023-6319 introduces another layer of threat by allowing operating system command injection.
This flaw is found in the getAudioMetadata method from the com.webos.service.attached storage manager service, where manipulated music lyrics files can lead to unauthorized command execution.
This vulnerability underscores the diverse methods attackers can employ to infiltrate the system.
The final vulnerability, CVE-2023-6319, permits attackers to inject authenticated commands by exploiting the com.webos.service.connectionmanager/tv/setVlanStaticAddress API endpoint.
This flaw enables the execution of commands on the device as the dbus user, who possesses permissions to the root user, further compounding the potential for exploitation.
The vulnerabilities affect a range of WebOS versions and models, including but not limited to:
The report provides a detailed technical analysis of how the vulnerabilities were exploited.
For instance, an error in the account handler allows attackers to skip PIN verification entirely, creating a privileged user profile without user interaction.
This and other technical insights into the vulnerabilities underscore the critical need for robust security measures in IoT devices.
The discovery of these vulnerabilities in LG WebOS TVs highlights the ongoing challenges in securing smart devices.
Users are urged to update their devices as soon as possible to mitigate the risks posed by these flaws.
Bitdefender’s report serves as a crucial reminder of the importance of cybersecurity in the ever-expanding IoT landscape.
Secure your emails in a heartbeat! To find your ideal email security vendor, Take a Free 30-Second Assessment.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…