LG Smart TVs Vulnerable to Pre-Auth Root Takeover From Local Network

Three vulnerabilities in LG's webOS platform have been identified as a chained exploit that allows an attacker on the same local network to gain root access to certain Smart TV models without requiring a PIN or any user interaction. The chain was validated on two specific models, the 32LQ636BPSA and the 27TQ600SW, both running firmware version 7.5.7-25. According to an advisory published by SSD Secure Disclosure on October 12, 2026, LG has released a fix for the issues. The Hacker News reported on the advisory on October 13, 2026. The advisory does not assign CVE identifiers to the vulnerabilities. Successful exploitation would provide an attacker with full root-level control of the affected device, potentially enabling unauthorized access to the camera, microphone, and installed applications. LG has not disclosed the individual CVE numbers or the detailed mechanics of the chain, but has confirmed that updating to the latest firmware version resolves the issues. Users are strongly encouraged to check for and apply available firmware updates through the TV's settings menu or the LG support site.