LG webOS Flaws Let Remote Attackers Execute Commands as Root Without Authentication

Security researchers have disclosed four serious vulnerabilities in LG webOS smart TVs that could allow an attacker to bypass authentication, create a privileged account, and ultimately execute commands with root-level access. The flaws, tracked as CVE-2023-6317 through CVE-2023-6320, affect selected LG TV models running webOS versions 4 through 7. Bitdefender researchers said the issue could give an attacker full control of a vulnerable television if it is reachable on the same local network. In some cases, the risk could extend beyond the home network because researchers found more than 91,000 exposed devices through Shodan. This search engine indexes internet-connected services. Bitdefender said LG fixed the reported issues...

Read the full article at the source.