TI-2023-05802 Aliases CVE-2023-6319 GHSA-rgwx-4v25-2mj5

Command injection in the getAudioMetadata method from the com.webos.service.attachedstoragemanager service

MEDIUM 51CWE-78Published 2024-04-09 · Updated 2024-08-02

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

A command injection vulnerability exists in the getAudioMetadata method from the com.webos.service.attachedstoragemanager service on webOS version 4 through 7. A series of specially crafted requests can lead to command execution as the root user. An attacker can make authenticated requests to trigger this vulnerability. * webOS 4.9.7 - 5.30.40 running on LG43UM7000PLA * webOS 5.5.0 - 04.50.51 running on OLED55CXPUA * webOS 6.3.3-442 (kisscurl-kinglake) - 03.36.50 running on OLED48C1PUB * webOS 7.3.1-43 (mullet-mebin) - 03.33.85 running on OLED55A23LA

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.06437 93rd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
LG	webOS	4.9.7; 5.5.0; 6.3.3; 7.3.1	—	No fix listed	CNA

webOS VendorLG Affected 4.9.7; 5.5.0; 6.3.3; 7.3.1 Fixed in — No fix listed CNA

CPE configurations NVD · 8

CPE	Versions	Role	Vendor
cpe:2.3:o:lg:webos:4.9.7:::::::*	4.9.7	Vulnerable	LG
cpe:2.3:h:lg:lg43um7000pla:-:::::::*	not specified by NVD	Running on	LG
cpe:2.3:o:lg:webos:5.5.0:::::::*	5.5.0	Vulnerable	LG
cpe:2.3:h:lg:oled55cxpua:-:::::::*	not specified by NVD	Running on	LG
cpe:2.3:o:lg:webos:6.3.3-442:::::::*	6.3.3-442	Vulnerable	LG
cpe:2.3:h:lg:oled48c1pub:-:::::::*	not specified by NVD	Running on	LG
cpe:2.3:o:lg:webos:7.3.1-43:::::::*	7.3.1-43	Vulnerable	LG
cpe:2.3:h:lg:oled55a23la:-:::::::*	not specified by NVD	Running on	LG

cpe:2.3:o:lg:webos:4.9.7:*:*:*:*:*:*:* Versions 4.9.7 Vulnerable ·LG
cpe:2.3:h:lg:lg43um7000pla:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·LG
cpe:2.3:o:lg:webos:5.5.0:*:*:*:*:*:*:* Versions 5.5.0 Vulnerable ·LG
cpe:2.3:h:lg:oled55cxpua:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·LG
cpe:2.3:o:lg:webos:6.3.3-442:*:*:*:*:*:*:* Versions 6.3.3-442 Vulnerable ·LG
cpe:2.3:h:lg:oled48c1pub:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·LG
cpe:2.3:o:lg:webos:7.3.1-43:*:*:*:*:*:*:* Versions 7.3.1-43 Vulnerable ·LG
cpe:2.3:h:lg:oled55a23la:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·LG

Remediation

No fixed version listed by the sources yet.

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2024-04-09
LG webOS — lgsecurity.lge.com/bulletins/tv
4 records Highest priority Priority MEDIUM 4 MEDIUM
Other records, highest priority first
- TI-2023-05801 Command injection in the processAnalyticsReport method from the com.webos.service.cloudupload servicePriority MEDIUM 49
- TI-2023-05803 Command injection in the com.webos.service.connectionmanager/tv/setVlanStaticAddress endpointPriority MEDIUM 48
- TI-2023-05800 PIN/prompt bypass on the secondscreen.gateway service allows access to the SSAP API without user interactionPriority MEDIUM 44
Show all 4 records → Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2023-6319
2026-10-03 Alias added: GHSA-rgwx-4v25-2mj5

References

Exploit 1

https://bitdefender.com/blog/labs/vulnerabilities-identified-in-lg-webos/

Advisory 1

https://lgsecurity.lge.com/bulletins/tv#updateDetails

TI-2023-05801 Command injection in the processAnalyticsReport method from the com.webos.service.cloudupload service CVSS 3.1CRITICAL 9.1
TI-2023-05803 Command injection in the com.webos.service.connectionmanager/tv/setVlanStaticAddress endpoint CVSS 3.1CRITICAL 9.1
TI-2023-05800 PIN/prompt bypass on the secondscreen.gateway service allows access to the SSAP API without user interaction CVSS 3.1CRITICAL 9.8
TI-2022-07782 The public API error causes for the attacker to be able to bypass API access control. CVSS 3.1CRITICAL 9.8
TI-2022-07783 V8 javascript engine (heap vulnerability) can cause privilege escalation ,which can impact on some webOS TV models. CVSS 3.1HIGH 7.8
TI-2020-07844 webOS TV Emulator privilege escalation vulnerability CVSS 3.1HIGH 7.8

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences