Loading story…
Researchers disclosed multiple smart TV vulnerabilities affecting LG webOS and Samsung Tizen OS, showing that consumer televisions can be compromised for deep system access. Bitdefender reported four flaws in LG webOS versions 4 through 7—CVE-2023-6317, CVE-2023-6318, CVE-2023-6319, and CVE-2023-6320—that can let attackers bypass authorization, create a privileged account, inject commands, and escalate privileges to root. The attack surface was amplified by Internet exposure: the vulnerable LG control service was intended for LAN use, but more than 91,000 devices were reportedly visible via Shodan. LG confirmed the issues after notification and released fixes before public disclosure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Calif published a report titled "Codex Hacked a Samsung TV," documenting a Samsung TV compromise and adding further public technical information about attacks against Samsung television platforms. The article represents a separate disclosure event from the earlier Tizen research.
Bishop Fox released research on Samsung Tizen OS affecting versions through 9.0, adding public technical detail about security issues in Samsung smart TV software. The publication marked a new disclosure event for Samsung's TV platform.
On April 9, 2024, Bitdefender publicly disclosed technical details of four LG webOS vulnerabilities that could allow attackers to take over TVs, including root-level command execution. Reporting noted that more than 91,000 devices appeared exposed to the Internet via the affected LAN-oriented service.
LG confirmed the reported vulnerabilities and released fixes on March 22, 2024. The patched issues included CVE-2023-6317, CVE-2023-6318, CVE-2023-6319, and CVE-2023-6320.
Bitdefender identified four vulnerabilities affecting LG webOS TV versions 4 through 7 and notified LG in November 2023. The flaws could be chained to bypass authorization, create a privileged user, and execute commands as root on affected televisions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
blog.calif.io
Open sourcebishopfox.com
Open sourcethehackernews.com
Open sourcebitdefender.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Samsung disclosed two **Galaxy S25** vulnerabilities reported through **Pwn2Own** that could be triggered remotely with user interaction. One flaw, **CVE-2025-58486** (`ZDI-26-224` / `ZDI-CAN-28456`), affects the **Samsung Account** application and allows arbitrary script execution in the current `WebView` through a cross-site scripting issue caused by improper validation of user-supplied data. The bug was assigned a **CVSS 6.3** score and was credited to Ken Gannon, 伊藤 剣 (@yogehi) of Mobile Hacking Lab, and Dimitrios Valsamaras (@Ch0pin). A second issue, **CVE-2025-58488** (`ZDI-26-223` / `ZDI-CAN-28331`), affects the **Smart Touch Call** application and can disclose sensitive information, including stored credentials, because of insufficient protection around URL-parameter-driven functionality. That flaw received a **CVSS 5.9** score and was credited to **Interrupt Labs**. In both cases, exploitation requires a victim to visit a malicious page or open a malicious file, and **Samsung has released updates** to remediate the vulnerabilities.
Jun 29, 2026
Researchers at Spur Intelligence found residential proxy SDKs embedded in **2,058 of 6,038** smart TV applications scanned across **LG webOS** and **Samsung Tizen**, indicating that more than a third of the apps analyzed could route third-party internet traffic through users’ home connections. The apps were often presented as benign utilities or ambient entertainment, including clocks, solitaire, fish tank displays, and puppy-themed apps, while some explicitly offered users a tradeoff between ads and joining a proxy network. Spur said smart TVs are especially attractive as proxy hosts because they are typically always on, rarely monitored like PCs, and can continue proxy activity even after an app is closed.
Jun 29, 2026
Samsung disclosed multiple vulnerabilities affecting Galaxy devices, including **remote code execution** flaws in the proprietary Quram image codec and a separate **improper access control** bug in the Routines automation feature. **CVE-2025-21042** and **CVE-2025-21043** are out-of-bounds write issues in `libimagecodec.quram.so` that can be triggered by specially crafted images delivered through MMS, email attachments, messaging apps, or web content, potentially with little or no user interaction. Samsung said **CVE-2025-21042** was fixed in the **April 2025 Security Maintenance Release**, while **CVE-2025-21043** was addressed in the **September 2025 SMR**. The disclosures revive longstanding concerns around Samsung’s proprietary image parsing stack, which Google Project Zero previously showed could be exploited through malformed Qmage images in a **zero-click MMS** chain that achieved code execution on a Galaxy Note 10+. Samsung also patched **CVE-2025-21058**, which allowed a local attacker on Android 15 and 16 devices to execute arbitrary code with **SystemUI privileges** via Galaxy Routines before versions **4.8.7.1** and **4.9.6.0**. Separately, Google fixed Android framework flaw **CVE-2025-32322** in the September 2025 Android Security Bulletin after it was found to let a malicious app bypass the MediaProjection consent dialog and silently capture screen content on Android 13 and 14.
Jun 29, 2026