Three flaws in LG's webOS let attackers on your Wi-Fi take full control of certain smart TVs without a PIN or any interaction. Here's what you need to know and how to protect yourself.
### The Kitchen TV That Opened Itself
Imagine watching TV, and someone on your Wi-Fi quietly takes over your LG Smart TV. No PIN, no pop-up, no warning. That's exactly what security researchers found. Three flaws in LG's webOS can be chained together, giving a local network attacker root access to certain models. The scary part? You don't have to do anything. The TV just... gives in.
### What Exactly Happened?
According to an advisory from SSD Secure Disclosure published on October 12, the attack works on two specific models: the 32LQ636BPSA and the 27TQ600SW, both running webOS 7.5.7-25. A root takeover means the attacker gets full control of the TV's operating system. They could install malware, spy on you, or use your TV as a stepping stone to other devices on your network.
Here's the kicker: it's a pre-auth attack. No password needed. No physical access. Just being on the same local network is enough. That could be your home Wi-Fi, a hotel network, or even a coffee shop's public hotspot if your TV is connected.
### How Bad Is It, Really?
If you own one of those affected models, it's pretty bad. But let's keep it in perspective. The attacker has to be on your local network. So it's not something a random hacker from across the world can do easily. Still, local network attacks are more common than you'd think. Roommates, guests, or someone who cracks your Wi-Fi password could pull it off.
And once they have root? Game over. They can:
- Install persistent malware that survives reboots
- Monitor what you watch and when
- Access other devices on your network through the TV
- Use your TV as part of a botnet
That's a lot of power for a device you probably just use for Netflix.
### LG's Response: A Fix, But Not a Recall
LG has issued a fix, according to the same advisory. But here's the thing: not everyone updates their TV. Many people never check for firmware updates. If you're one of them, your TV could still be vulnerable. LG hasn't issued a recall or a widespread warning, so it's on you to check.
You can usually find updates in your TV's settings menu under "About" or "Software Update." If you own one of the affected models, do it now. Don't wait.
### What This Means for Your Smart Home
This isn't just about LG. It's a wake-up call for anyone with smart devices. Your TV, fridge, thermostat, even your light bulbs can be entry points. The more connected your home, the bigger your attack surface. So what can you do?
- Keep all smart devices updated
- Use a separate network for IoT devices if possible
- Change default passwords (yes, even on your TV)
- Consider whether your TV really needs to be online 24/7
"The most secure smart TV is the one that's not connected," one security researcher told me. It's a bit extreme, but you get the point.
### Should You Panic?
No. Panic doesn't help. But you should take this seriously. If you have an affected LG TV, update it. If you're not sure, check the model number on the back. And if you're in the market for a new TV, maybe look for one with a better security track record.
At the end of the day, this is a reminder that convenience and security often pull in opposite directions. The more we connect, the more we have to protect. So do yourself a favor: update your TV, and maybe don't connect it to the same network as your work laptop. Your future self will thank you.
