A significant security issue has been identified in certain LG Smart TV models running webOS. Researchers have found that three vulnerabilities can be linked together to grant an attacker on the same local network root access to these devices without requiring a PIN or any interaction from the TV owner. This vulnerability could potentially expose users to unauthorized control over their smart TVs. LG has responded promptly to this discovery by releasing a fix, as detailed in an advisory by SSD Secure Disclosure on October 12. The vulnerabilities were tested on two specific models, the 32LQ636BPSA and the 27TQ600SW, which run webOS version 7.5.7-25 on firmware 04.54.40. It remains unclear if other models or firmware versions are also affected. LG Smart TV owners are urged to check for available firmware updates to secure their devices, as no alternative workaround is currently available for those unable to update immediately. The attack method involves exploiting a service on port 3001, used for pairing with the LG ThinQ app. By replaying a manifest from a pre-installed app signed with a trusted test certificate, attackers bypass the PIN requirement and obtain a privileged key. This key is then used to launch another app, cmp-client, and direct it to a malicious page. This page retains access to PalmServiceBridge, an interface to the TV's system services, allowing the attacker to send root shell commands through the system logging service, pmlogd. This is not the first time vulnerabilities in the local network attack surface of LG smart TVs have been exploited to gain root access. Previous incidents in 2024 and 2025 saw similar vulnerabilities, which were subsequently patched by LG. The current vulnerability chain was demonstrated by an anonymous researcher at the TyphoonPWN 2026 event in Seoul, earning them third place in the LG webOS category. No CVE identifiers have been assigned, and there have been no reports of these vulnerabilities being exploited in the wild.