The Exploit Bulletin — Tuesday, October 13, 2026: 1 issue requires action
Tuesday, October 13, 2026 — 1 issue requires action. If you run none of the software below, you are done.
Affects: LG webOS
1. Preauth Full-Chain Root Command Execution via sync-demo App (LG webOS)
UNVERIFIED PUBLIC REPORT · NO CVE · REMOTE CODE EXECUTION · CRITICAL
A full working exploit chain (exploit.py with reproduce steps) achieving unauthenticated root code execution on named LG webOS models was published within the last day, with LG reported to have already shipped a fix that owners must apply.
SSD Disclosure published a detailed write-up and working proof-of-concept chaining three bugs in LG webOS TVs: a signed-manifest replay that bypasses the PIN prompt to obtain a SECURE-tier client-key without authentication, an SSRF via cmp-client's interactiveUrl that reaches a private Luna service, and a command injection in pmlogd's collectAllLog via the targetDir parameter, yielding root shell execution. The researcher states this placed third in the LG webOS category at TyphoonPWN 2026 and that LG has issued a fix.
Affected: LG 32LQ636BPSA and LG 27TQ600SW running webOS 7.5.7-25 (Rockhopper, mullet-mirima), firmware 04.54.40; other models/firmware not stated
How to Test: Check whether you operate the named models (LG 32LQ636BPSA, 27TQ600SW) on webOS 7.5.7-25 / firmware 04.54.40, or any webOS TV with the sync-demo app installed; verify whether port 3001 (Luna/WSS) is reachable from guest networks or the internet, and apply the vendor's non-interactive proof-file check pattern from the report only in a controlled test environment, not production.
How to Patch: Apply the firmware update referenced in LG's security bulletin (https://lgsecurity.lge.com/bulletins/tv#updateDetails) for the affected TV models. Until updated, restrict LAN/network access to the TV's control plane (WSS port 3001) from untrusted devices, and remove or disable the sync-demo app (com.webos.app.sync-demo) if present.
Evidence: SSD Disclosure: LG webOS sync-demo Preauth RCE
Read on the web · Every past edition
The Exploit Bulletin is free and daily. It publishes only what security teams must act on today — nothing else. Forward it freely.
Spot an error, or an exploit we missed? Reply here or email [email protected].
