LG

87 CVEs across 163 LG products. Browse LG vulnerabilities, severities, and proof-of-concept exploits.

LG products with known CVEs

ProductCVEs
Simple Editor25
Simple Editor25
V60 Thin Q 5g9
Supersign Cms8
Webos8
G67
Q67
Q87
V207
V307
X3007
X4007
X5007
X Cam7
LG Led Assistant6
G75
V405
Cv14
Cv1s4
Cv34
Cv54
Cv74
Cv7as4
Dh104
Dh154
Dh304
Dh354
Dh404
Dh54
Dh504
G84
K204
K304
K404
K504
Oled48c1pub4
Oled55cxpua4
Q604
Q704
V354
V504
V604
G53
G6\+3
Oled55a23la3
V103
V30\+3
V30s Thinq3
Lg43um7000pla2
Supersign Media Editor2
LG CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2024-6179Medium6.12024-06-20Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LG Electronics SuperSign CMS allows Reflected XSS. This i…
CVE-2024-6178Medium6.12024-06-20Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LG Electronics SuperSign CMS allows Reflected XSS. This i…
CVE-2024-6177Medium6.12024-06-20Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in LG Electronics SuperSign CMS allows Reflected XSS…
CVE-2023-41181Medium5.32024-05-03LG SuperSign Media Editor getSubFolderList Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sen…
CVE-2023-40517High7.52024-05-03LG SuperSign Media Editor ContentRestController getObject Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers…
CVE-2023-40516High7.82024-05-03LG Simple Editor Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on…
CVE-2023-40515High7.52024-05-03LG Simple Editor joinAddUser Improper Input Validation Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-servic…
CVE-2023-40514Medium6.52024-05-03LG Simple Editor FileManagerController getImageByFilename Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers…
CVE-2023-40513Medium6.52024-05-03LG Simple Editor UserManageController getImageByFilename Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers t…
CVE-2023-40512Medium6.52024-05-03LG Simple Editor PlayerController getImageByFilename Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to di…
CVE-2023-40511High7.52024-05-03LG Simple Editor checkServer Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations…
CVE-2023-40510High7.52024-05-03LG Simple Editor getServerSetting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installa…
CVE-2023-40509Critical9.12024-05-03LG Simple Editor deleteCanvas Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files o…
CVE-2023-40508Critical9.12024-05-03LG Simple Editor putCanvasDB Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files on…
CVE-2023-40507High7.52024-05-03LG Simple Editor copyContent XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensit…
CVE-2023-40506High7.52024-05-03LG Simple Editor copyContent XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensit…
CVE-2023-40505Critical9.82024-05-03LG Simple Editor createThumbnailByMovie Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary…
CVE-2023-40504Critical9.82024-05-03LG Simple Editor readVideoInfo Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on a…
CVE-2023-40503High7.52024-05-03LG Simple Editor saveXmlFile XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensit…
CVE-2023-40502Critical9.12024-05-03LG Simple Editor cropImage Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files on a…
CVE-2023-40501Critical9.82024-05-03LG Simple Editor copyContent Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary co…
CVE-2023-40500Critical9.82024-05-03LG Simple Editor copyContent Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary co…
CVE-2023-40499Critical9.12024-05-03LG Simple Editor mkdir Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files on affec…
CVE-2023-40498Critical9.82024-05-03LG Simple Editor cp Command Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on af…
CVE-2023-40497Critical9.82024-05-03LG Simple Editor saveXml Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affec…
CVE-2023-40496High7.52024-05-03LG Simple Editor copyStickerContent Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive…
CVE-2023-40495High7.52024-05-03LG Simple Editor copyTemplateAll Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive inf…
CVE-2023-40494Critical9.12024-05-03LG Simple Editor deleteFolder Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files o…
CVE-2023-40493Critical9.82024-05-03LG Simple Editor copySessionFolder Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary cod…
CVE-2023-40492Critical9.12024-05-03LG Simple Editor deleteCheckSession Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary f…
CVE-2023-6320Critical9.12024-04-09A command injection vulnerability exists in the com.webos.service.connectionmanager/tv/setVlanStaticAddress endpoint on webOS versions 5 and 6. A series of spe…
CVE-2023-6319Critical9.12024-04-09A command injection vulnerability exists in the getAudioMetadata method from the com.webos.service.attachedstoragemanager service on webOS version 4 through 7…
CVE-2023-6318Critical9.12024-04-09A command injection vulnerability exists in the processAnalyticsReport method from the com.webos.service.cloudupload service on webOS version 5 through 7. A se…
CVE-2023-6317High7.22024-04-09A prompt bypass exists in the secondscreen.gateway service running on webOS version 4 through 7. An attacker can create a privileged account without asking the…
CVE-2024-2863Medium5.32024-03-25This vulnerability allows remote attackers to traverse paths via file upload on the affected LG LED Assistant.
CVE-2024-2862Critical9.12024-03-25 This vulnerability allows remote attackers to reset the password of anonymous users without authorization on the affected LG LED Assistant.
CVE-2024-1886Low3.02024-02-26 This vulnerability allows remote attackers to traverse the directory on the affected webOS of LG Signage.
CVE-2024-1885Medium6.32024-02-26This vulnerability allows remote attackers to execute arbitrary code on the affected webOS of LG Signage.
CVE-2023-44129Low3.62023-09-27The vulnerability is that the Messaging ("com.android.mms") app patched by LG forwards attacker-controlled intents back to the attacker in the exported "com.an…
CVE-2023-44128Medium5.02023-09-27he vulnerability is to delete arbitrary files in LGInstallService ("com.lge.lginstallservies") app. The app contains the exported "com.lge.lginstallservies.Ins…
CVE-2023-44127Low3.62023-09-27he vulnerability is that the Call management ("com.android.server.telecom") app patched by LG launches implicit intents that disclose sensitive data to all thi…
CVE-2023-44126Low3.62023-09-27The vulnerability is that the Call management ("com.android.server.telecom") app patched by LG sends a lot of LG-owned implicit broadcasts that disclose sensit…
CVE-2023-44125Medium6.12023-09-27The vulnerability is the use of implicit PendingIntents without the PendingIntent.FLAG_IMMUTABLE set that leads to theft and/or (over-)write of arbitrary files…
CVE-2023-44124Medium6.12023-09-27The vulnerability is to theft of arbitrary files with system privilege in the Screen recording ("com.lge.gametools.gamerecorder") app in the "com/lge/gametools…
CVE-2023-44123Medium6.12023-09-27The vulnerability is the use of implicit PendingIntents with the PendingIntent.FLAG_MUTABLE set that leads to theft and/or (over-)write of arbitrary files with…
CVE-2023-44122Medium6.12023-09-27The vulnerability is to theft of arbitrary files with system privilege in the LockScreenSettings ("com.lge.lockscreensettings") app in the "com/lge/lockscreens…
CVE-2023-44121Medium5.02023-09-27The vulnerability is an intent redirection in LG ThinQ Service ("com.lge.lms2") in the "com/lge/lms/things/ui/notification/NotificationManager.java" file. This…
CVE-2023-4616High7.52023-09-04This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG LED Assistant. Authentication is not required to e…
CVE-2023-4615High7.52023-09-04This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG LED Assistant. Authentication is not required to e…
CVE-2023-4614Critical9.82023-09-04This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG LED Assistant. Authentication is not required to exploit t…
CVE-2023-4613Critical9.82023-09-04This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG LED Assistant. Authentication is not required to exploit t…
CVE-2022-45422High7.82022-11-21When LG SmartShare is installed, local privilege escalation is possible through DLL Hijacking attack. The LG ID is LVE-HOT-220005.
CVE-2022-23731High7.82022-03-11V8 javascript engine (heap vulnerability) can cause privilege escalation ,which can impact on some webOS TV models.
CVE-2022-23730Critical9.82022-03-11The public API error causes for the attacker to be able to bypass API access control.
CVE-2022-23727High7.82022-01-28There is a privilege escalation vulnerability in some webOS TVs. Due to wrong setting environments, local attacker is able to perform specific operation to exp…
CVE-2021-38306Critical9.82021-08-24Network Attached Storage on LG N1T1*** 10124 devices allows an unauthenticated attacker to gain root access via OS command injection in the en/ajp/plugins/acce…
CVE-2021-26688Critical9.82021-02-04An issue was discovered on LG Wing mobile devices with Android OS 10 software. The biometric sensor has weak security properties. The LG ID is LVE-SMP-200030 (…
CVE-2020-7807Medium5.62020-09-14A vulnerability that can hijack a DLL file that is loaded during products(LGPCSuite_Setup, IPSFULLHD, LG_ULTRAWIDE, ULTRA_HD_Driver Setup) installation into a…
CVE-2020-13842High7.82020-06-05An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 (MTK chipsets). A dangerous AT command was made available even though it…
CVE-2020-13841Critical9.82020-06-05An issue was discovered on LG mobile devices with Android OS 9 and 10 (MTK chipsets). An AT command handler allows attackers to bypass intended access restrict…
CVE-2020-13840Critical9.82020-06-05An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 (MTK chipsets). Code execution can occur via an MTK AT command handler bu…
CVE-2020-13839Critical9.82020-06-05An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 (MTK chipsets). Code execution can occur via a custom AT command handler…
CVE-2019-20781High7.82020-04-29An issue was discovered in LG Bridge before April 2019 on Windows. DLL Hijacking can occur.
CVE-2019-20777Critical9.82020-04-17An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, 8.1, and 9.0 software. WapService mishandles OTA Provisioning on V40 and G7 de…
CVE-2019-20769High7.82020-04-17An issue was discovered in LG PC Suite for LG G3 and earlier (aka LG PC Suite v5.3.27 and earlier). DLL Hijacking can occur via a Trojan horse DLL in the curre…
CVE-2020-9759Medium4.62020-03-23A Vulnerability of LG Electronic web OS TV Emulator could allow an attacker to escalate privileges and overwrite certain files. This vulnerability is due to wr…
CVE-2013-3685High7.02020-02-12A Privilege Escalation Vulnerability exists in Sprite Software Spritebud 1.3.24 and 1.3.28 and Backup 2.5.4105 and 2.5.4108 on LG Android smartphones due to a…
CVE-2018-14839Critical9.82019-05-14LG N1A1 NAS 3718.510 is affected by: Remote Command Execution. The impact is: execute arbitrary code (remote). The attack vector is: HTTP POST with parameters.
CVE-2019-7404High7.52019-05-13An issue was discovered on LG GAMP-7100, GAPM-7200, and GAPM-8000 routers. An unauthenticated user can read a log file via an HTTP request containing its full…
CVE-2019-8372High7.02019-02-18The LHA.sys driver before 1.1.1811.2101 in LG Device Manager exposes functionality that allows low-privileged users to read and write arbitrary physical memory…
CVE-2018-17173Critical9.82018-09-21LG SuperSign CMS allows remote attackers to execute arbitrary code via the sourceUri parameter to qsr_server/device/getThumbnail.
CVE-2018-16706High7.52018-09-14LG SuperSign CMS allows TVs to be rebooted remotely without authentication via a direct HTTP request to /qsr_server/device/reboot on port 9080.
CVE-2018-16288High8.62018-09-14LG SuperSign CMS allows reading of arbitrary files via signEzUI/playlist/edit/upload/..%2f URIs.
CVE-2018-16287Critical9.82018-09-14LG SuperSign CMS allows file upload via signEzUI/playlist/edit/upload/..%2f URIs.
CVE-2018-16286Critical9.82018-09-14LG SuperSign CMS allows authentication bypass because the CAPTCHA requirement is skipped if a captcha:pass cookie is sent, and because the PIN is limited to fo…
CVE-2018-16946High7.52018-09-12LG LNB*, LND*, LNU*, and LNV* smart network camera devices have broken access control. Attackers are able to download /updownload/t.report (aka Log & Report) f…
CVE-2018-15482Critical9.82018-08-17Certain LG devices based on Android 6.0 through 8.1 have incorrect access control for MLT application intents. The LG ID is LVE-SMP-180006.
CVE-2018-14982Critical9.82018-08-17Certain LG devices based on Android 6.0 through 8.1 have incorrect access control in the GNSS application. The LG ID is LVE-SMP-180004.
CVE-2018-14981Critical9.82018-08-17Certain LG devices based on Android 6.0 through 8.1 have incorrect access control for SystemUI application intents. The LG ID is LVE-SMP-180005.
CVE-2018-10229Medium4.82018-05-04A hardware vulnerability in GPU memory modules allows attackers to accelerate micro-architectural attacks through the use of the JavaScript WebGL API.
CVE-2017-15361Medium5.92017-10-16The Infineon RSA library 1.02.013 in Infineon Trusted Platform Module (TPM) firmware, such as versions before 0000000000000422 - 4.34, before 000000000000062b…
CVE-2014-0997High7.52017-09-26WiFiMonitor in Android 4.4.4 as used in the Nexus 5 and 4, Android 4.2.2 as used in the LG D806, Android 4.2.2 as used in the Samsung SM-T310, Android 4.1.2 as…
CVE-2016-10135Medium5.52017-01-13An issue was discovered on LG devices using the MTK chipset with L(5.0/5.1), M(6.0/6.0.1), and N(7.0) software, and RCA Voyager Tablet, BLU Advance 5.0, and BL…
CVE-2014-87572015-02-17LG On-Screen Phone (OSP) before 4.3.010 allows remote attackers to bypass authorization via a crafted request.
CVE-2014-72522014-12-05Multiple unspecified vulnerabilities in the Syslink driver for Texas Instruments OMAP mobile processor, as used on NTT DOCOMO ARROWS Tab LTE F-01D, ARROWS X LT…
CVE-2014-72432014-12-05LG Electronics Mobile WiFi router L-09C, L-03E, and L-04D does not restrict access to the web administration interface, which allows remote attackers to obtain…
CVE-2013-36662013-05-29The LG Hidden Menu component for Android on the LG Optimus G E973 allows physically proximate attackers to execute arbitrary commands by entering USB Debugging…