The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Bitdefender disclosed a chain of four vulnerabilities affecting certain LG TVs running webOS 4–7: it could bypass an authorization prompt, create privileged access, and then use command-injection flaws to run commands as root or dbus. LG released fixes before the vulnerabilities were publicly reported in April 2024. Owners should install the software update currently offered for their exact TV model and region; the published examples are not a complete list of affected or fixed sets.
How the vulnerability chain worked
The reported issue was not a single flaw that automatically gave any nearby device control of every LG TV. Bitdefender described a sequence: CVE-2023-6317 bypassed an authorization prompt, after which separate command-injection vulnerabilities could be used through the service.
As an Amazon Associate I earn from qualifying purchases.
- CVE-2023-6317: an authorization-prompt bypass that could allow a privileged account to be created without entering the on-screen PIN.
- CVE-2023-6318 and CVE-2023-6319: authenticated command-injection paths that the researchers said could reach root access.
- CVE-2023-6320: an authenticated command-injection flaw that ran commands as the dbus user. Bitdefender described that account as having permissions similar to root.
The distinction matters: the prompt bypass supplied a route to privileged access, while the later flaws were separate steps in the reported chain. Bitdefender’s researchers summarized their result this way: “These vulnerabilities let us gain root access on the TV after bypassing the authorization mechanism.”
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Why “local network” does not mean internet exposure was impossible
The affected control service is used by LG’s ThinQ smartphone app and runs on ports 3000 and 3001. Bitdefender said it was intended for local-network access. In a 2024 Shodan observation, the researchers found more than 91,000 devices exposing the service to the internet. That is a historical observation reported by Bitdefender—not a current count of vulnerable TVs, and not evidence that every device counted was successfully exploited.
#1 Best Overall
- DYNAMIC QNED COLOR: Enhances color accuracy for vibrant, more lifelike viewing with certified 100% Color Volume
- A7 AI PROCESSOR 4K GEN9: Enhanced brightness, improved sound, refined picture detail. It all comes together for a thrilling watching experience
- HDR10 PRO: Dynamically adjusts brightness, revealing crisp details and vivid color in both bright and dark scenes for a stunning, lifelike picture
- FILMMAKER MODE: Watch films just how the directors envisioned them with automatic preservation of the director's original colors, settings and frame rates for a true at-home cinematic experience FILMMAKER MODE with Ambient Light Technology
- WEBOS SMART PLATFORM: Delivers smarter, easier streaming, plus Google Gemini
For a home user, the practical network check is whether the TV’s control service has been made reachable from outside the home network. Do not configure internet-facing access to the TV, and review your router for any inbound port-forwarding rules for ports 3000 or 3001. The report does not establish that internet access was necessary in every case; its intended service context was the LAN.
Models and software examples in Bitdefender’s report
Bitdefender listed the following vulnerable model-and-software combinations. They are examples, not an exhaustive inventory of affected TVs or a complete list of fixed versions.
Rank #2
- Full HD IPS Display: Features 1920 X 1080 resolution with IPS technology for sharp imagery, vivid colors, and excellent visual contrast
- Wide Viewing Angle: Enjoy consistent picture quality from multiple viewing positions with wide vertical and horizontal viewing angles whether seated or standing
- webOS Smart TV Platform: Access streaming apps and smart features through the intuitive webOS interface with personalized recommendations for every family member
- Wireless Connection Support: Connect your devices seamlessly without cables for convenient streaming and content sharing
- Built-in Stereo Speakers: Equipped with dual 5W stereo speakers delivering clear audio and includes wall mounting capability for flexible installation options
| TV model | Example webOS / firmware range listed |
|---|---|
| LG43UM7000PLA | webOS 4.9.7–5.30.40 |
| OLED55CXPUA | webOS 5.5.0–04.50.51 |
| OLED48C1PUB | webOS 6.3.3-442 (kisscurl-kinglake)–03.36.50 |
| OLED55A23LA | webOS 7.3.1-43 (mullet-mebin)–03.33.85 |
A TV that is not listed should not be assumed unaffected: the examples do not cover every model, region, or software build. Likewise, matching a listed model alone does not establish that the TV is still vulnerable if it has since received an update.
What LG TV owners should do now
- Find the exact model and installed software version. Check the TV’s Settings for its model information and software version. Menu labels and locations can vary by model and region.
- Check for a software update on the TV. Open Settings and look for the software update option, then install any update offered for that set. The report says LG released automatic and manual updates, but does not provide a complete fixed-version table by model and region.
- Confirm model-specific support information. If the TV reports that it is up to date, compare its installed version with current LG support information for the exact model and region. The available vulnerability report does not establish a single fixed version that applies to every TV.
- Check router exposure. Remove any inbound forwarding rules that make ports 3000 or 3001 reachable from the internet. The service was intended for LAN use, not public exposure.
If your TV cannot find an update, or the support information is unclear, contact LG support with the model number and installed software version. Do not rely on a model-family name or a version from another region to decide whether your particular set has the fix.
Rank #3
- Complete LG 32 Inch LB65 Series bundle includes an HD LED Smart AI TV, HDMI cable, streaming bundle, and 12 Month CPS Warranty for a complete home entertainment solution.
- HD LED display delivers vibrant colors, sharp detail, and enhanced clarity for everyday television viewing, movies, sports, and streaming content.
- LG AI Processor intelligently optimizes picture and sound quality to provide an improved viewing experience across live TV, streaming services, and connected devices.
- webOS Smart TV platform offers easy access to popular streaming apps, LG Channels, personalized recommendations, and an intuitive user interface.
- Built-in WiFi and Bluetooth connectivity allow quick access to online entertainment and wireless pairing with compatible devices and accessories.
Disclosure and patch timeline
Bitdefender’s disclosure timeline records that it notified LG on November 1, 2023, and LG confirmed the issues on November 15, 2023. LG released patches on March 22, 2024. Bitdefender published its report on April 9, 2024; the report page was updated on April 18, 2024. In other words, the public report described flaws for which LG had already released updates.
The exact fixed firmware for every model and region is not established in the available information. The safest way to determine the status of an individual TV is to check the current update and support information for that exact set.
Quick Recap
Rank #4
- 4k Ultra HD (2160p resolution): Enjoy breathtaking HDR10 4K movies and TV shows at 4 times the resolution of Full HD, and upscale your current content to Ultra HD-level picture quality.
- High Dynamic Range: Provides a wide range of color details and sharper contrast, from the brightest whites to the deepest blacks.
- All-in-one: Get right to your good stuff. With Fire TV, you can enjoy a world of entertainment from apps like Prime Video, Netflix, Disney+, Hulu, and HBO Max. Plus, stream for free with Fire TV Channels, Pluto TV, Tubi, and more. Access over 1.8 million movies and TV episodes. Subscriptions may be required. Feature and content availability may vary.
- Smart Home: Your smart home hub. Pair Fire TV with compatible smart home devices to see live camera feeds, use AirPlay, control your lighting and thermostat, and more.
- Free Content: Stream for free. Access over 1 million free movies and TV episodes from popular ad-supported streaming apps like Fire TV Channels, Tubi, and Pluto TV. Subscriptions may be required. Feature and content availability may vary.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
