CVE-2023-6319 is a Critical severity (CVSS 9.1) flaw in the getAudioMetadata method of the com.webos.service.attachedstoragemanager service on LG webOS TVs, versions 4 through 7 depending on the model. A series of crafted authenticated requests can run commands as root. Install LG's latest webOS update for your TV and keep the TV off the internet.
What's affected
The NVD record lists the affected builds and TV models.
- webOS 4.9.7 to 5.30.40 on LG43UM7000PLA.
- webOS 5.5.0 to 04.50.51 on OLED55CXPUA.
- webOS 6.3.3-442 (kisscurl-kinglake) to 03.36.50 on OLED48C1PUB.
- webOS 7.3.1-43 (mullet-mebin) to 03.33.85 on OLED55A23LA.
- Fixed: Bitdefender's timeline lists a patch release on 22 March 2024, and the report went public on 9 April 2024. Specific fixed build numbers are in LG's TV security bulletins, which did not render when I fetched them. Check the bulletin for your model.
- Scope: Bitdefender's research on LG webOS TVs is the source for these four CVEs. The report says the flaws affect webOS versions 4 through 7 and let an attacker gain root on the TV after getting past the authorization mechanism. The vulnerable service is meant for the local network only, but the report says a search on Shodan found more than 91,000 devices exposing it to the internet.
How to check if you're exposed
Televisions are easy to forget in an inventory, and many of them are on the same network as laptops and servers.
- List LG TVs and signage displays in offices, meeting rooms, lobbies and labs, with the model number.
- On the TV, open the settings and read the software version, then compare with the builds above and with LG's bulletin for your model.
- Check your firewall and router for port forwards that reach TVs. Ports 3000 and 3001 are the ones Bitdefender names for the vulnerable service, so a forward to those ports is a red flag.
- Confirm automatic updates are enabled and that the TV can reach LG's update servers.
What to do now
- Install the latest webOS update on every LG TV in scope, following LG's bulletin for your model.
- Remove any port forwarding or public exposure of TVs. Nothing on a TV should be reachable from the internet.
- Put TVs and other consumer or entertainment devices on a separate guest or IoT network, away from corporate systems.
- Turn off remote control features and the smartphone control app pairing if you do not use them.
- Retire TVs that no longer receive updates from LG, or keep them fully offline from the network.
Why it matters
The weakness is CWE-78. The affected method reads metadata from audio files on attached storage, such as a USB drive. The description says crafted requests to it can lead to command execution as root, and that the attacker needs authenticated requests.
This one reaches further back than the other command injection entries, since it covers webOS 4 through 7, including the older LG43UM7000PLA builds. Older TVs are the ones most likely to be past their update window, so the practical advice is to isolate them. The kev flag is false and the report does not describe exploitation in the wild.
Quick check
Which models does this cover?
The four models and builds in the list above, from webOS 4.9.7 to 7.3.1-43.
What if my TV no longer gets updates?
Keep it offline or on an isolated network, or replace it.
Sources
- Bitdefender: vulnerabilities identified in LG webOS
- LG product security bulletins (listed in the record, did not render when fetched)
Last reviewed: 19 October 2026.
