LG webOS TV Zero-Click RCE

A zero-click vulnerability in LG webOS. According to Shodan, roughly 42,000 LG webOS devices are directly exposed on the internet.

Affected environment

Version: webOS 10.2.2-5901 (Build 33.31.23)

Vulnerability chain

1. SSG R2R pairing bypass — the PIN sent to port 3001 is unconditionally accepted as the correct PIN. This bypasses authentication to establish pairing and obtain app-launch permission.
2. Native-privilege acquisition (undisclosed — unpatched) — an attacker page is loaded while a privileged native context is retained, letting that page make native calls. Details are withheld as it is not yet fixed.
3. Unsigned IPK install — dev/install, gated only by a single on-disk devmode flag, skips signature verification. That flag can itself be turned on via a Luna call, so an unsigned IPK can be installed and arbitrary code executed.

Code-level analysis

1. SSG R2R pairing bypass

File: com.webos.service.secondscreen.gateway/helpers/system/pairing-manager.js

In R2R mode the server only checks the presence and length (PIN_LENGTH = 8) of the client-supplied r2rPin. There is no step that compares it against a correct PIN generated by the TV:

if (!!options.r2rMode) {
    if (!!options.r2rPin === false) {
        return Q.reject("r2rPin does not exist");
    } else if (options.r2rPin.length !== this.PIN_LENGTH) {
        return Q.reject("r2rPin.length is not PIN_LENGTH");
    }
}

That value is then stored as-is as the correct PIN, and the popup that would be shown to the user is short-circuited to an empty string in R2R mode:

if (!!this.pairingRequests[pairingRequestId].r2rMode) {
    pin = this.pairingRequests[pairingRequestId].r2rPin;   // attacker-controlled
} else {
    pin = this.generatePin();                              // normal: random 8 digits
}
this.pairingRequests[pairingRequestId].pin = pin;          // stored as the correct PIN

When the attacker submits the same PIN they sent at register time via ssap://pairing/setPin, pairing succeeds. An empty signatures[].signature in the manifest still passes, granting even the PROTECTED-tier LAUNCH permission.

2. Native-privilege acquisition (undisclosed)

This step is not yet patched, so its details are not disclosed.

Using the app-launch permission gained from vulnerability 1 as a foothold, this flaw loads an attacker-controlled external web page while retaining a privileged native IPC context. As a result, the attacker page’s script can make native calls directly, which leads into the setDevMode and dev/install calls of vulnerability 3. The specific affected component, permission, code, and reproduction steps are withheld until it is fixed.

3. Unsigned IPK install

File: usr/sbin/appinstalld

The privileged native context obtained from vulnerability 2 can turn on the devmode flag directly via setDevMode. The passphrase entry required in normal use exists only in the LG Developer UI, not at the LS2 method level:

luna://com.webos.service.devmode/setDevMode {"enabled": true}

Once the flag is on, dev/install — unlike the production path — does not call signature verification (pkgverifier/verifyIpk) and accepts an unsigned IPK as state:"installed". Launching the installed type:"native" IPK enables arbitrary code execution.

Root cause

• RC-1 · SSG R2R pairing (CWE-287, Improper Authentication) — R2R was designed as a “trusted path” meant only for LG’s internal integration client (cis), yet SSG never verifies that the caller actually is that internal client. So instead of a secret PIN generated by the TV, the value sent by the attacker is used as the correct PIN, and no popup appears. The crux is that the basis of trust lies in the “caller’s declaration” rather than the “caller’s identity.” (R2R has been removed in the latest version.)
• RC-2 (CWE-668, Exposure to Wrong Sphere) — arbitrary external content is executed within a context that holds excessive native privileges. It’s a confused-deputy setup where the external page inherits the app’s identity. (Unpatched — details withheld.)
• RC-3 · Unsigned install (CWE-494, No Integrity Check) — unlike the production path, dev/install does not call signature verification (pkgverifier) and is guarded only by a single on-disk flag. Moreover, the passphrase check for setDevMode, which turns that flag on, exists only in the LG Developer UI, not at the LS2 method level. The root cause is that the integrity gate has no cryptographic anchor.

Impact

• Arbitrary OS command execution on LG webOS with no user interaction.
• The only visible trace by which a user could notice the attack is a single flicker of the screen.

Demo

A demo of an attacker on the same network achieving remote code execution with only the TV’s IP and no user interaction.

Disclosure timeline

• 2026-05-27 — Reported 3 vulnerabilities to LG PSRT (Product Security Response Team).
• 2026-05-28 — LG PSRT acknowledged receipt and replied that it would forward the report to the development team.
• 2026-06-09 — Inquired about the status.
• 2026-06-09 — LG PSRT reply:
  • Vulnerability 1 (SSG R2R pairing bypass) — replied that the vendor was already aware of it.
  • Vulnerability 2 (withheld in this post) — replied that it is acknowledged as a valid vulnerability.
  • Vulnerability 3 (unsigned IPK install) — replied that it is intended behavior.
• 2026-08-24 — Confirmed vulnerability 1 patched.

Exploit code and detailed payloads are not disclosed. Please reach out separately if needed.