CVE-2023-6317

High

Description

A prompt bypass exists in the secondscreen.gateway service running on webOS version 4 through 7. An attacker can create a privileged account without asking the user for the security PIN. Full versions and TV models affected: webOS 4.9.7 - 5.30.40 running on LG43UM7000PLA webOS 5.5.0 - 04.50.51 running on OLED55CXPUA webOS 6.3.3-442 (kisscurl-kinglake) - 03.36.50 running on OLED48C1PUB webOS 7.3.1-43 (mullet-mebin) - 03.33.85 running on OLED55A23LA

SeverityHigh

CVSS7.2

Exploit probability—

ProductLg Webos

PublishedApr 9, 2024

First seenApr 9, 2024

Weakness typeCWE-639Authorization bypass through user-controlled key

How to fix

Vendor advisories

lgsecurity.lge.com/bulletins/tv#updateDetails

Affected products

Product	Affected versions	Fixed in
lg webos	4.9.7, 5.5.0, 6.3.3-442, 7.3.1-43	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.