Read the docs
TI-2023-05800 Aliases CVE-2023-6317GHSA-rm4x-93m8-4qcv

PIN/prompt bypass on the secondscreen.gateway service allows access to the SSAP API without user interaction

Priority MEDIUM 44CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-639.

Summary

A prompt bypass exists in the secondscreen.gateway service running on webOS version 4 through 7. An attacker can create a privileged account without asking the user for the security PIN.  Full versions and TV models affected: webOS 4.9.7 - 5.30.40 running on LG43UM7000PLA webOS 5.5.0 - 04.50.51 running on OLED55CXPUA webOS 6.3.3-442 (kisscurl-kinglake) - 03.36.50 running on OLED48C1PUB   webOS 7.3.1-43 (mullet-mebin) - 03.33.85 running on OLED55A23LA

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01087 65th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LGWebOS 4.9.7; 5.5.0; 6.3.3-442; 7.3.1-43—No fix listedCNA
  • WebOS VendorLG Affected 4.9.7; 5.5.0; 6.3.3-442; 7.3.1-43 Fixed in — No fix listed CNA

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:o:lg:webos:4.9.7:*:*:*:*:*:*:*4.9.7VulnerableLG
cpe:2.3:h:lg:lg43um7000pla:-:*:*:*:*:*:*:*not specified by NVDRunning onLG
cpe:2.3:o:lg:webos:5.5.0:*:*:*:*:*:*:*5.5.0VulnerableLG
cpe:2.3:h:lg:oled55cxpua:-:*:*:*:*:*:*:*not specified by NVDRunning onLG
cpe:2.3:o:lg:webos:6.3.3-442:*:*:*:*:*:*:*6.3.3-442VulnerableLG
cpe:2.3:h:lg:oled48c1pub:-:*:*:*:*:*:*:*not specified by NVDRunning onLG
cpe:2.3:o:lg:webos:7.3.1-43:*:*:*:*:*:*:*7.3.1-43VulnerableLG
cpe:2.3:h:lg:oled55a23la:-:*:*:*:*:*:*:*not specified by NVDRunning onLG
  • cpe:2.3:o:lg:webos:4.9.7:*:*:*:*:*:*:* Versions 4.9.7 Vulnerable ·LG
  • cpe:2.3:h:lg:lg43um7000pla:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·LG
  • cpe:2.3:o:lg:webos:5.5.0:*:*:*:*:*:*:* Versions 5.5.0 Vulnerable ·LG
  • cpe:2.3:h:lg:oled55cxpua:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·LG
  • cpe:2.3:o:lg:webos:6.3.3-442:*:*:*:*:*:*:* Versions 6.3.3-442 Vulnerable ·LG
  • cpe:2.3:h:lg:oled48c1pub:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·LG
  • cpe:2.3:o:lg:webos:7.3.1-43:*:*:*:*:*:*:* Versions 7.3.1-43 Vulnerable ·LG
  • cpe:2.3:h:lg:oled55a23la:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·LG

Remediation

No fixed version listed by the sources yet.

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    LG webOS — lgsecurity.lge.com/bulletins/tv

    4 records Highest priority Priority MEDIUM 4 MEDIUM

    Other records, highest priority first

    • TI-2023-05802 Command injection in the getAudioMetadata method from the com.webos.service.attachedstoragemanager servicePriority MEDIUM 51
    • TI-2023-05801 Command injection in the processAnalyticsReport method from the com.webos.service.cloudupload servicePriority MEDIUM 49
    • TI-2023-05803 Command injection in the com.webos.service.connectionmanager/tv/setVlanStaticAddress endpointPriority MEDIUM 48
    Show all 4 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-6317
  2. 2026-10-03 Alias added: GHSA-rm4x-93m8-4qcv

References

Exploit 1

Advisory 1

  • TI-2023-05802 Command injection in the getAudioMetadata method from the com.webos.service.attachedstoragemanager service CVSS 3.1CRITICAL 9.1
  • TI-2023-05801 Command injection in the processAnalyticsReport method from the com.webos.service.cloudupload service CVSS 3.1CRITICAL 9.1
  • TI-2023-05803 Command injection in the com.webos.service.connectionmanager/tv/setVlanStaticAddress endpoint CVSS 3.1CRITICAL 9.1
  • TI-2022-07782 The public API error causes for the attacker to be able to bypass API access control. CVSS 3.1CRITICAL 9.8
  • TI-2022-07783 V8 javascript engine (heap vulnerability) can cause privilege escalation ,which can impact on some webOS TV models. CVSS 3.1HIGH 7.8
  • TI-2020-07844 webOS TV Emulator privilege escalation vulnerability CVSS 3.1HIGH 7.8
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences