CVE-2023-6320

Critical

Description

A command injection vulnerability exists in the com.webos.service.connectionmanager/tv/setVlanStaticAddress endpoint on webOS versions 5 and 6. A series of specially crafted requests can lead to command execution as the dbus user. An attacker can make authenticated requests to trigger this vulnerability. Full versions and TV models affected: * webOS 5.5.0 - 04.50.51 running on OLED55CXPUA * webOS 6.3.3-442 (kisscurl-kinglake) - 03.36.50 running on OLED48C1PUB

SeverityCritical

CVSS9.1

Exploit probability—

ProductLg Webos

PublishedApr 9, 2024

First seenApr 9, 2024

Weakness typeCWE-78OS command injection

How to fix

Vendor advisories

lgsecurity.lge.com/bulletins/tv#updateDetails

Affected products

Product	Affected versions	Fixed in
lg webos	5.5.0, 6.3.3-442	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.