CVE-2023-6318 is a Critical severity (CVSS 9.1) flaw in the processAnalyticsReport method of the com.webos.service.cloudupload service on LG webOS TVs, versions 4 through 7 depending on the model. A series of crafted authenticated requests can run commands as root. Install LG's latest webOS update for your TV and keep the TV off the internet.
What's affected
The NVD record lists the affected builds and TV models.
- webOS 4.9.7 to 5.30.40 on LG43UM7000PLA.
- webOS 5.5.0 to 04.50.51 on OLED55CXPUA.
- webOS 6.3.3-442 (kisscurl-kinglake) to 03.36.50 on OLED48C1PUB.
- webOS 7.3.1-43 (mullet-mebin) to 03.33.85 on OLED55A23LA.
- Fixed: Bitdefender's timeline lists a patch release on 22 March 2024, and the report went public on 9 April 2024. Specific fixed build numbers are in LG's TV security bulletins, which did not render when I fetched them. Check the bulletin for your model.
- Scope: Bitdefender's research on LG webOS TVs is the source for these four CVEs. The report says the flaws affect webOS versions 4 through 7 and let an attacker gain root on the TV after getting past the authorization mechanism. The vulnerable service is meant for the local network only, but the report says a search on Shodan found more than 91,000 devices exposing it to the internet.
How to check if you're exposed
Televisions are easy to forget in an inventory, and many of them are on the same network as laptops and servers.
- List LG TVs and signage displays in offices, meeting rooms, lobbies and labs, with the model number.
- On the TV, open the settings and read the software version, then compare with the builds above and with LG's bulletin for your model.
- Check your firewall and router for port forwards that reach TVs. Ports 3000 and 3001 are the ones Bitdefender names for the vulnerable service, so a forward to those ports is a red flag.
- Confirm automatic updates are enabled and that the TV can reach LG's update servers.
What to do now
- Install the latest webOS update on every LG TV in scope, following LG's bulletin for your model.
- Remove any port forwarding or public exposure of TVs. Nothing on a TV should be reachable from the internet.
- Put TVs and other consumer or entertainment devices on a separate guest or IoT network, away from corporate systems.
- Turn off remote control features and the smartphone control app pairing if you do not use them.
- Retire TVs that no longer receive updates from LG, or keep them fully offline from the network.
Why it matters
The weakness is CWE-78, where input reaches an operating system command without being neutralized. The description says a series of crafted requests to this method lead to command execution as the root user, and that the attacker needs to make authenticated requests.
That requirement is lower than it sounds. The PIN bypass in CVE-2023-6317 from the same report removes the need for a legitimate account, which is how Bitdefender describes gaining root after getting past the authorization mechanism. Root on a TV means control of a device with a camera, a microphone or network access in some models, on a network with other devices. This entry covers webOS 5 through 7 only. The kev flag is false.
Quick check
Does this need a login?
The description says authenticated requests. Bitdefender's report shows another flaw, CVE-2023-6317, that gets past the authorization step.
Which webOS versions are affected?
webOS 5 through 7 on the models listed above.
Sources
- Bitdefender: vulnerabilities identified in LG webOS
- LG product security bulletins (listed in the record, did not render when fetched)
Last reviewed: 19 October 2026.
