LG fixes webOS flaws allowing root takeover from a local network

LG has issued a fix for three webOS vulnerabilities that let an attacker on the same local network gain root access to certain smart TVs without a PIN or owner interaction, according to an SSD Secure Disclosure advisory published October 12. The chain bypasses pairing authentication, loads an attacker-controlled page through a built-in app and injects commands into a logging service running with root privileges. It was tested on models 32LQ636BPSA and 27TQ600SW with webOS 7.5.7-25 and firmware 04.54.40. Other affected models or versions are unknown. No exploitation in the wild has been reported, and no workaround is available for owners unable to update.