LG has issued a fix for three vulnerabilities affecting certain smart TVs running webOS, after security researchers reported that the flaws could be chained to give an attacker root access from the same local network. According to the published details, the attack did not require a PIN or any interaction from the TV owner.

While the report focuses on specific consumer TV models tested by the researchers, the broader business lesson is clear: connected displays and other internet-enabled devices can create avoidable security exposure when they are left unpatched or placed on the same network as business systems.

What happened

The vulnerabilities were disclosed in a report referenced by The Hacker News, which said three weaknesses in LG's webOS could be combined to achieve a pre-authentication root takeover from the local network. Researchers said the chain was tested on two TV models: the 32LQ636BPSA and the 27TQ600SW, running webOS 7.5.7-25 on the firmware version cited in the report.

LG has issued a fix, according to an advisory published by SSD Secure Disclosure on 12 October. Based on the available information, the reported attack requires the attacker to be on the same local network as the affected TV.

The source material does not state that all LG smart TVs are affected, nor does it indicate evidence of active exploitation in the wild. Businesses should therefore treat this as a confirmed vulnerability disclosure with a vendor fix, rather than as proof of a widespread incident.

Why it matters for European businesses

For many organisations, smart TVs are not just consumer devices. They are often used in meeting rooms, reception areas, retail stores, hospitality settings, waiting rooms and digital signage deployments. These devices are frequently connected to office Wi‑Fi or shared internal networks, but may not be covered by the same patching, monitoring and asset-management processes applied to laptops, servers or mobile phones.

If a vulnerable device can be taken over from the local network, it may become a foothold inside a business environment. Even where a TV does not store sensitive business data itself, a compromised device can still increase operational and security risk. At a minimum, it may expose weaknesses in network segmentation, device inventory and update management.

This matters particularly for SMEs, which often have mixed environments combining office IT, guest Wi‑Fi, point-of-sale systems, cameras, signage and smart devices on shared infrastructure. A local-network vulnerability is especially relevant in these setups because an attacker may not need direct internet exposure if they can first gain access through guest access, poorly separated wireless networks or another compromised internal device.

Who may be affected

• SMEs and offices using smart TVs in meeting rooms or shared spaces on the same network as business devices.
• Retail and hospitality businesses using connected displays for signage, menus or customer entertainment.
• E-commerce and omnichannel businesses operating showrooms, collection points or physical customer spaces with networked displays.
• IT teams and managed service providers responsible for device inventory, patching and network segmentation across mixed environments.
• Digital agencies and installers that deploy screens, signage or smart displays for clients.

What companies should consider

• Check affected devices. Review whether your business uses LG smart TVs, especially the models and webOS versions referenced in the disclosure, and verify whether the vendor fix has been applied.
• Update firmware promptly. Ensure smart TVs and other connected display devices are included in regular patch-management processes, not treated as one-off consumer hardware.
• Segment networks. Place TVs, signage systems and other IoT devices on separate VLANs or isolated networks rather than the same segment used by laptops, servers or core business applications.
• Review guest and office Wi‑Fi separation. If local-network access is enough for exploitation, weak segmentation between guest access and internal systems increases risk.
• Maintain an asset inventory. Many organisations do not have a reliable list of all connected screens and smart devices. Building that inventory is a practical step for reducing blind spots.
• Harden unused features. Disable unnecessary services or connectivity options where operationally possible, especially on devices used only for display purposes.
• Include IoT devices in security reviews. TVs, cameras, printers and signage endpoints should be part of routine vulnerability and configuration assessments.

For European businesses, the immediate issue is not limited to one TV brand. The more important takeaway is that smart devices on local networks can carry enterprise security implications, even when they appear low risk. Companies that rely on connected displays should treat them as managed endpoints and ensure patching and segmentation policies extend beyond traditional IT hardware.