Vulnerable LG webOS TVs can be compromised from the local network without a PIN or user action, creating a path for surveillance, persistence and lateral movement. GajIPS detects the attack traffic
Severity: Medium | Priority: 3
On October 12, 2026, Three vulnerabilities in LG’s webOS smart TV software when chained together, they let an attacker on the same network as the TV take full control of it with root privileges. The attacker needs no PIN, and the owner doesn’t have to do anything.
The attack works in three stages.
Once the TV is compromised, an attacker can watch what is displayed, listen through any connected microphone, install persistent malware, and use the TV as a foothold to attack other devices on the same network. Smart TVs in meeting rooms and reception areas are often connected to corporate networks and rarely monitored or updated.
If GajIPS detects the malicious web page used in this attack, identify the TV that requested it and treat it as possibly compromised:
GajIPS may also raise an informational alert when a device in your network accepts connections from the internet on port 3001, the port the TV uses for pairing. Check whether that device is an LG TV. If it is, remove any port forwarding or UPnP mappings to it on your router or firewall. Other software also uses port 3001, so the device may not be a TV.
To reduce the risk:
This attack comes from inside the local network, so GajOS Bulwark can only see it if the TVs are on a separate segment that it routes. That is one more reason to isolate them.