CVE-2023-6320

CVE-2023-6320: A command injection vulnerability affects webOS 5.x and 6.x, specifically the com.webos.service.connectionmanager/tv/setVlanStaticAddress endpoint. The root cause is a command execution path that can be triggered by a sequence of authenticated requests, allowing execution as the db...

CVE-2023-6320 Command injection in the com.webos.service.connectionmanager/tv/setVlanStaticAddress endpoint

A command injection vulnerability exists in the com.webos.service.connectionmanager/tv/setVlanStaticAddress endpoint on webOS versions 5 and 6. A series of specially crafted requests can lead to command execution as the dbus user. An attacker can make authenticated requests to trigger this...

CVE-2023-6320 Command injection in the com.webos.service.connectionmanager/tv/setVlanStaticAddress endpoint

A command injection vulnerability exists in the com.webos.service.connectionmanager/tv/setVlanStaticAddress endpoint on webOS versions 5 and 6. A series of specially crafted requests can lead to command execution as the dbus user. An attacker can make authenticated requests to trigger this...

CVE-2023-6319 Command injection in the getAudioMetadata method from the com.webos.service.attachedstoragemanager service

A command injection vulnerability exists in the getAudioMetadata method from the com.webos.service.attachedstoragemanager service on webOS version 4 through 7. A series of specially crafted requests can lead to command execution as the root user. An attacker can make authenticated requests to...

CVE-2023-6319

CVE-2023-6319 affects LG webOS: a command injection in getAudioMetadata of the com.webos.service.attachedstoragemanager. Affected webOS versions include 4.9.7–5.30.40, 5.5.0–04.50.51, 6.3.3-442–03.36.50, and 7.3.1-43–03.33.85. The vulnerability allows an attacker to execute commands as root via s...

CVE-2023-6319 Command injection in the getAudioMetadata method from the com.webos.service.attachedstoragemanager service

A command injection vulnerability exists in the getAudioMetadata method from the com.webos.service.attachedstoragemanager service on webOS version 4 through 7. A series of specially crafted requests can lead to command execution as the root user. An attacker can make authenticated requests to...

CVE-2023-6318 Command injection in the processAnalyticsReport method from the com.webos.service.cloudupload service

A command injection vulnerability exists in the processAnalyticsReport method from the com.webos.service.cloudupload service on webOS version 5 through 7. A series of specially crafted requests can lead to command execution as the root user. An attacker can make authenticated requests to trigger...

CVE-2023-6318 Command injection in the processAnalyticsReport method from the com.webos.service.cloudupload service

A command injection vulnerability exists in the processAnalyticsReport method from the com.webos.service.cloudupload service on webOS version 5 through 7. A series of specially crafted requests can lead to command execution as the root user. An attacker can make authenticated requests to trigger...

CVE-2023-6318

LG webOS versions 5 through 7 are affected by a command injection in the processAnalyticsReport method of the com.webos.service.cloudupload service, enabling root-level code execution via specially crafted authenticated requests. Affected versions listed include webOS 5.5.0 – 04.50.51, 6.3.3-442,...

CVE-2023-6317

CVE-2023-6317 describes a prompt bypass in webOS secondscreen.gateway that lets an attacker create a privileged account without user PIN on affected webOS versions. Affected: webOS 4.9.7–5.30.40, 5.5.0–04.50.51, 6.3.3-442 (kisscurl-kinglake)–03.36.50, 7.3.1-43 (mullet-mebin)–03.33.85. Root cause:...

CVE-2023-6317 PIN/prompt bypass on the secondscreen.gateway service allows access to the SSAP API without user interaction

A prompt bypass exists in the secondscreen.gateway service running on webOS version 4 through 7. An attacker can create a privileged account without asking the user for the security PIN. Full versions and TV models affected: webOS 4.9.7 - 5.30.40 running on LG43UM7000PLA webOS 5.5.0 - 04.50.51...

CVE-2023-6317 PIN/prompt bypass on the secondscreen.gateway service allows access to the SSAP API without user interaction

A prompt bypass exists in the secondscreen.gateway service running on webOS version 4 through 7. An attacker can create a privileged account without asking the user for the security PIN. Full versions and TV models affected: webOS 4.9.7 - 5.30.40 running on LG43UM7000PLA webOS 5.5.0 - 04.50.51...

91,000 Smart LG TV Devices Vulnerable to Remote Takeover

By Waqas LG TVs vulnerable! Update now to block hackers from taking control & stealing data webOS 4-7. Millions at risk! This is a post from HackRead.com Read the original post: 91,000 Smart LG TV Devices Vulnerable to Remote Takeover...

Researchers Discover LG Smart TV Vulnerabilities Allowing Root Access

Multiple security vulnerabilities have been disclosed in LG webOS running on its smart televisions that could be exploited to bypass authorization and gain root access on the devices. The findings come from Romanian cybersecurity firm Bitdefender, which discovered and reported the flaws in Novemb...

LG webOS 安全漏洞

LG webOS is a Linux kernel-based smart TV operating system from LG, a South Korean company. A security vulnerability exists in LG webOS that originates from a command injection vulnerability in the om.webos.service.connectionmanager/tv/setVlasticAddress endpoint. Affected products and...

LG webOS 安全漏洞

LG webOS is a Linux kernel-based smart TV operating system from South Korea's Lakin LG. A security vulnerability exists in LG webOS that originates from a hint bypass in the secondscreen.gateway service. An attacker can exploit the vulnerability to create a privileged account without asking the...

LG webOS 操作系统命令注入漏洞

LG webOS is a Linux kernel-based smart TV operating system from LG Corporation in South Korea. An OS command injection vulnerability exists in LG webOS, which stems from an OS command injection vulnerability in the processAnalyticsReport method of the com.webos.service.cloudupload service. Affect...

LG webOS 操作系统命令注入漏洞

LG webOS is a Linux kernel-based smart TV operating system from LG Corporation in South Korea. An OS command injection vulnerability exists in LG webOS, which originates from an OS command injection vulnerability in the getAudioMetadata method of the com.webos.service.attachedstoragemanager...

CVE-2024-1885

This vulnerability allows remote attackers to execute arbitrary code on the affected webOS of LG Signage...

CVE-2024-1886

This vulnerability allows remote attackers to traverse the directory on the affected webOS of LG Signage...