Pre-auth root takeover of webOS TVs from the local network via ThinQ pairing service on port 3001 (LG webOS)
Full technical details of a working pre-auth root chain were published on October 12–13, so anyone with a foothold on an office, guest or conference-room network can now reproduce it; LG TVs in meeting rooms and signage are routinely on shared segments, and a rooted TV is a persistent pivot and eavesdropping device.
Three chained webOS flaws let anyone on the same network as an LG smart TV obtain root without a PIN or owner interaction. The attacker replays a built-in app manifest signed with a test certificate the firmware trusts to the ThinQ pairing service on TCP/3001, which skips the PIN prompt and hands over a privileged key; that key launches the built-in cmp-client app pointed at an attacker page, which retains access to the internal PalmServiceBridge and injects shell commands into the root-running pmlogd logging service. The chain was demonstrated at TyphoonPWN 2026 and published by SSD Secure Disclosure; it was tested on two models running webOS 7.5.7-25 / firmware 04.54.40. SSD says LG has issued a fix. No CVE has been assigned, no LG advisory is in the material, and no exploitation has been reported.
Affected: webOS 7.5.7-25 on firmware 04.54.40, tested on models 32LQ636BPSA and 27TQ600SW; other models and firmware versions not stated
How to Test
Inventory LG TVs on your network (webOS devices advertise via SSDP/mDNS and expose TCP/3000-3001 for ThinQ pairing; a port scan for 3001 across office and conference-room VLANs will find them). On each TV check Settings > Support > About This TV for the webOS/firmware version: 7.5.7-25 / 04.54.40 is confirmed affected; treat any firmware predating the October 2026 update as suspect since LG has not published an affected list. Review network logs for unexpected connections to port 3001 from workstations or guest devices, and for TVs making outbound requests to unfamiliar hosts (the chain loads an attacker-controlled page).
How to Patch
Apply the latest LG firmware via Settings > Support > Software Update and turn on automatic updates. Where updates cannot be applied yet, isolate TVs on a dedicated IoT VLAN with inbound access to TCP/3001 restricted to the devices that genuinely need ThinQ pairing, or block it entirely; decommission TVs that no longer receive firmware updates.