Three vulnerabilities in LG's webOS have been discovered that can be chained together to grant an attacker on the same local network root access to certain smart TVs. This attack can be performed without requiring any user interaction or a PIN. LG has since released a fix for these vulnerabilities, as first reported by The Hacker News.
The vulnerabilities affect specific LG TV models running webOS 7.5.7-25 on firmware 04.54.40, though it is unknown if other versions are impacted. The attack chain begins by exploiting a service on port 3001, used by the LG ThinQ app for pairing. An attacker can replay a manifest from a built-in app, signed with a test certificate that the firmware trusts. This bypasses the PIN prompt and grants a privileged key. With this key, the attacker launches another app, cmp-client, and directs it to a malicious page. This page can then access PalmServiceBridge, an internal interface to the TV's system services. Through this bridge, the attacker can execute commands as root by exploiting the system logging service, pmlogd, which does not properly validate input. No CVE identifiers have been assigned, and no exploitation in the wild has been reported.
Source: The Hacker News
