LG WebOS TV Vulnerability Enables Full Device Takeover by Bypassing Authentication

A security vulnerability has been discovered in LG WebOS TV systems that allows attackers to gain complete control over affected devices by bypassing authentication mechanisms.

The vulnerability, disclosed during the TyphoonPWN 2025 LG Category competition where it won first place, affects LG WebOS 43UT8050 and potentially other versions of the smart TV platform.

Vulnerability Mechanics and Impact

The security flaw centers around the browser-service component within WebOS TV, which automatically opens port 18888 when users connect USB storage devices to their television.

This service is designed to allow peer devices to download files from specific directories including /tmp/usb and /tmp/home.office.documentviewer through the /getFile?path= API endpoint.

However, the critical weakness lies in the application’s failure to properly validate the path parameter, creating a path traversal vulnerability that enables unauthorized file downloads from anywhere on the device without ...