CVE-2023-6317 is a High severity (CVSS 7.2) flaw in the secondscreen.gateway service on LG webOS TVs, versions 4 through 7 depending on the model. An attacker can create a privileged account without the TV asking the user for the security PIN. Install LG's latest webOS update for your TV and keep the TV off the internet.
What's affected
The NVD record lists the affected builds and TV models.
- webOS 4.9.7 to 5.30.40 on LG43UM7000PLA.
- webOS 5.5.0 to 04.50.51 on OLED55CXPUA.
- webOS 6.3.3-442 (kisscurl-kinglake) to 03.36.50 on OLED48C1PUB.
- webOS 7.3.1-43 (mullet-mebin) to 03.33.85 on OLED55A23LA.
- Fixed: Bitdefender's timeline lists a patch release on 22 March 2024, and the report went public on 9 April 2024. Specific fixed build numbers are in LG's TV security bulletins, which did not render when I fetched them. Check the bulletin for your model.
- Scope: Bitdefender's research on LG webOS TVs is the source for these four CVEs. The report says the flaws affect webOS versions 4 through 7 and let an attacker gain root on the TV after getting past the authorization mechanism. The vulnerable service is meant for the local network only, but the report says a search on Shodan found more than 91,000 devices exposing it to the internet.
How to check if you're exposed
Televisions are easy to forget in an inventory, and many of them are on the same network as laptops and servers.
- List LG TVs and signage displays in offices, meeting rooms, lobbies and labs, with the model number.
- On the TV, open the settings and read the software version, then compare with the builds above and with LG's bulletin for your model.
- Check your firewall and router for port forwards that reach TVs. Ports 3000 and 3001 are the ones Bitdefender names for the vulnerable service, so a forward to those ports is a red flag.
- Confirm automatic updates are enabled and that the TV can reach LG's update servers.
What to do now
- Install the latest webOS update on every LG TV in scope, following LG's bulletin for your model.
- Remove any port forwarding or public exposure of TVs. Nothing on a TV should be reachable from the internet.
- Put TVs and other consumer or entertainment devices on a separate guest or IoT network, away from corporate systems.
- Turn off remote control features and the smartphone control app pairing if you do not use them.
- Retire TVs that no longer receive updates from LG, or keep them fully offline from the network.
Why it matters
The weakness is CWE-639. Bitdefender explains that the service on ports 3000 and 3001 is used by the LG ThinQ smartphone app. To pair the app, a user must type a PIN shown on the TV screen. The report says an error in the account handler lets an attacker skip that PIN check and create a privileged user profile.
The PIN is the only thing that proves a person is in the room with the TV, so skipping it removes the control. This bug is also the first link in a chain, because the other three CVEs in the same report need an authenticated request. The kev flag for this record is false, and the report does not describe exploitation in the wild.
Quick check
What does the PIN bypass give an attacker?
A privileged user profile on the TV without the on screen PIN. The other LG CVEs in the same report use authenticated requests.
Is this a remote bug?
The service is meant for the local network. Bitdefender's search found many TVs exposing it to the internet, which is why exposure matters.
Sources
- Bitdefender: vulnerabilities identified in LG webOS
- LG product security bulletins (listed in the record, did not render when fetched)
Last reviewed: 19 October 2026.
