Which LG TV models are affected by the webOS root takeover?

The attack chain was demonstrated on the LG 32LQ636BPSA and 27TQ600SW running webOS 7.5.7-25 on firmware 04.54.40. Whether other models or firmware versions are affected is not known — LG has not published a full affected-products list. Check your model and firmware in Settings, then check for updates.

Does the attacker need my WiFi password or any interaction from me?

No. The attacker only needs to be on the same local network — a compromised laptop, a guest's infected phone, or malware on any device sharing your WiFi. There is no PIN prompt to bypass socially and no click required from the TV owner. That is what makes local-network hygiene (guest networks, IoT segmentation) the real defense.

Is there a workaround if my LG TV has no firmware update available?

No documented workaround exists. If no update is available for your model, the only mitigations are to disconnect the TV from the network when not in use, or isolate it on a separate guest/IoT network segment so untrusted devices cannot reach it. LG has issued a patch — updating is the fix.

webOS PRE-AUTH ROOT — NO CVE ASSIGNED — PATCH AVAILABLE

Can someone on your WiFi take over your LG smart TV?

Demonstrated at TyphoonPWN 2026: three flaws in LG's webOS chain together to hand an attacker on your local network root access to certain smart TVs — no PIN, no click, no interaction from you. The attack enters through the TV's own pairing service, escalates through a trusted built-in app, and finishes with a command injection in a logging service that runs as root. LG has issued a fix. This free 30-second check tells you if you're at risk. No signup, nothing installed.

The 30-second check

Check your model and firmware — on the TV: Settings → General → About This TV. Note the model number, the webOS version, and the software (firmware) version.

Model 32LQ636BPSA or 27TQ600SW on webOS 7.5.7-25 / firmware 04.54.40 → CONFIRMED EXPOSED. These are the exact models and firmware the attack was demonstrated on. Update immediately.

Any other LG webOS model → scope unknown. LG has not published which other models or firmware versions are affected. Treat an unpatched TV as at-risk and update anyway.

Firmware already includes LG's October 2026 patch → fixed. The patch was issued per the SSD Secure Disclosure advisory of October 12, 2026.

Check for a firmware update right now — Settings → General → About This TV → Check for Updates. Install anything it offers, then re-check — LG sometimes ships fixes in staged rollouts.

No update offered and your model is on the confirmed list? Check again in a few days — and until then, see step 3. There is no other workaround.

Check who shares your TV's network — this attack needs no internet and no phishing: any compromised device on the same local network can reach the TV's pairing service on port 3001. Ask yourself:

Do guests, tenants, or visitors join your main WiFi?
Is the TV on the same network as laptops, phones, and cheap IoT gadgets?
Does your router offer a guest network or IoT VLAN? If yes, move the TV onto it — a segmented TV can't be reached by an attacker's laptop on the main network.

TV on the main network with untrusted devices around → exposed attack surface even after patching, for the next flaw. Network segmentation is the durable fix.

How the chain works (so you know what you're defending)

Flaw 1 — PIN bypass: the TV's pairing service (port 3001, used by the LG ThinQ app) accepts a replayed manifest from the built-in sync-demo app, signed with a test certificate the firmware trusts. A permission in that manifest skips the PIN prompt and hands over a privileged key.
Flaw 2 — trusted app redirection: with that key, the attacker launches another built-in app, cmp-client, and points it at an attacker-controlled page. The app doesn't validate where it navigates, and the loaded page keeps access to PalmServiceBridge — the internal interface to the TV's system services.
Flaw 3 — root command injection: through that bridge, the attacker calls the collectAllLog method of pmlogd, the system logging service. It builds shell commands from caller-controlled input without sanitizing it. pmlogd runs as root — so the injected command runs as root.

No CVE identifiers have been assigned and no in-the-wild exploitation has been reported as of October 15, 2026. This is not the first webOS local-network root chain: Bitdefender disclosed a different set in 2024 (patched March 2024), and another chain was shown at TyphoonPWN 2025.

If you're exposed, do this now

Update the firmware today — this is the fix. Don't wait for the TV's auto-update schedule.
Segment your network: put the TV (and all IoT) on a guest network or IoT VLAN, away from laptops and phones. This shrinks the attack surface for this flaw and the next one.
Can't update yet? Disconnect the TV from the network when you're not actively using its smart features. There is no other workaround.
Don't assume one brand is safe: smart TVs run full operating systems with network services, microphones, and your streaming credentials — treat them like the computers they are.

Check what else on your network is exposed → BreachHunter

This page checked one flaw chain. BreachHunter hunts attacker infrastructure and exposed services across your domains and network footprint — the same local-network attack surface this TV flaw lives on.