Your LG television trusted a demo app, and that was enough to own it

Your television listens on port 3001. That is the door the LG ThinQ phone app knocks on when it pairs with the set, and until recently anyone already on your Wi-Fi could walk straight through it.

SSD Secure Disclosure published the details on 12 October. The work came from an anonymous researcher who took third place in the LG webOS category at TyphoonPWN in Seoul back in May. Three weaknesses stack into one clean attack. webOS ships with a demo app called sync-demo, and its permissions manifest is signed with a test certificate the firmware still trusts. Replay that manifest and the pairing service skips the PIN prompt entirely and hands over a privileged key. From there the attacker points another built-in app, cmp-client, at a web page of their choosing, and that page keeps access to an internal bridge reaching the system logging service. The logging service accepts shell commands through a field it never checks, and it runs as root.

No PIN, no on-screen prompt, nothing for the owner to approve. The chain was proven on two sets, a 32LQ636BPSA and a 27TQ600SW running webOS 7.5.7-25 on firmware 04.54.40. Whether other models share the flaw has not been established. LG has issued a fix, and there is no workaround for anyone who cannot update yet.

The catch is that someone has to be on your network already, which sounds reassuring until you count what is on it: a visitor's phone, a laptop that picked something up, a cheap plug or camera from a brand that stopped shipping firmware years ago. Let the TV update itself, then go and look at what else is sitting there. Tendvane's network scan lists every device currently on your home network, which is usually the first time people discover how many there are.