LG Electronics — recent CVEs https://vulnogram.org/ Most recent CVEs assigned by LG Electronics (lge). https://vulnogram.org/seaview/icons/lge.png LG Electronics — recent CVEs https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT CVE-2026-15929 · 7.1 HIGH 👻 https://vulnogram.org/CVE-2026-15929 https://vulnogram.org/CVE-2026-15929 Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in LG Electronics SmartShare allows SQL Injection. This issue affects SmartShare: through 2.3.1712.1202, which is supported on Microsoft Windows 10 and… High Unsupported When Assigned Thu, 30 Jul 2026 01:50:16 GMT CVE-2025-10538 · 8.8 HIGH 🌩️ 👻 — Authentication Bypass in LG Innotek Camera https://vulnogram.org/CVE-2025-10538 https://vulnogram.org/CVE-2025-10538 An authentication bypass vulnerability exists in LG Innotek camera models LND7210 and LNV7210R. The vulnerability allows a malicious actor to gain access to camera information including user account information. High Network Exploitable Unsupported When Assigned Wed, 01 Oct 2025 04:02:35 GMT CVE-2025-10204 · 7.1 HIGH 👻 — Unauth Admin Reset Password on AC Smart II https://vulnogram.org/CVE-2025-10204 https://vulnogram.org/CVE-2025-10204 A vulnerability has been discovered in AC Smart II where passwords can be changed without authorization. This page contains a hidden form for resetting the administrator password. The attacker can manipulate the page using developer tools to display… High Unsupported When Assigned Sun, 14 Sep 2025 12:43:30 GMT CVE-2025-7742 · 8.3 HIGH 🌩️ 👻 — Authentication Bypass in LG Innotek Camera https://vulnogram.org/CVE-2025-7742 https://vulnogram.org/CVE-2025-7742 An authentication vulnerability exists in the LG Innotek camera model LNV5110R firmware that allows a malicious actor to upload an HTTP POST request to the devices non-volatile storage. This action may result in remote code execution that allows an a… High Network Exploitable Unsupported When Assigned Thu, 24 Jul 2025 23:28:32 GMT CVE-2024-6179 · 4.8 MEDIUM — XSS vulnerability in LG SuperSign CMS https://vulnogram.org/CVE-2024-6179 https://vulnogram.org/CVE-2024-6179 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LG Electronics SuperSign CMS allows Reflected XSS. This issue affects SuperSign CMS: from 4.1.3 before < 4.3.1. Medium Thu, 20 Jun 2024 01:53:11 GMT CVE-2024-6178 · 4.8 MEDIUM — XSS vulnerability in LG SuperSign CMS https://vulnogram.org/CVE-2024-6178 https://vulnogram.org/CVE-2024-6178 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LG Electronics SuperSign CMS allows Reflected XSS. This issue affects SuperSign CMS: from 4.1.3 before < 4.3.1. Medium Thu, 20 Jun 2024 01:51:50 GMT CVE-2024-6177 · 4.8 MEDIUM — XSS vulnerability in LG SuperSign CMS https://vulnogram.org/CVE-2024-6177 https://vulnogram.org/CVE-2024-6177 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in LG Electronics SuperSign CMS allows Reflected XSS. This issue affects SuperSign CMS: from 4.1.3 before < 4.3.1. Medium Thu, 20 Jun 2024 00:52:25 GMT CVE-2024-6176 · 4.8 MEDIUM — Port scanning vulnerability in LG SuperSign CMS https://vulnogram.org/CVE-2024-6176 https://vulnogram.org/CVE-2024-6176 Allocation of Resources Without Limits or Throttling vulnerability in LG Electronics LG SuperSign CMS allows Port Scanning.This issue affects LG SuperSign CMS: from 4.1.3 before < 4.3.1. Medium Thu, 20 Jun 2024 00:44:15 GMT CVE-2024-2863 · 5.3 MEDIUM 🌩️ — Path traversal via file upload on LG LED Assistant https://vulnogram.org/CVE-2024-2863 https://vulnogram.org/CVE-2024-2863 This vulnerability allows remote attackers to traverse paths via file upload on the affected LG LED Assistant. Medium Network Exploitable Mon, 25 Mar 2024 06:39:46 GMT CVE-2024-2862 · 9.1 CRITICAL 🌩️ — Password reset vulnerability without authorization on LG LED Assistant https://vulnogram.org/CVE-2024-2862 https://vulnogram.org/CVE-2024-2862 This vulnerability allows remote attackers to reset the password of anonymous users without authorization on the affected LG LED Assistant. Critical Network Exploitable Mon, 25 Mar 2024 06:31:34 GMT CVE-2024-1886 · 3 LOW — Absolute path traversal attack on LG Signage https://vulnogram.org/CVE-2024-1886 https://vulnogram.org/CVE-2024-1886 This vulnerability allows remote attackers to traverse the directory on the affected webOS of LG Signage. Low Mon, 26 Feb 2024 07:53:53 GMT CVE-2024-1885 · 6.3 MEDIUM — Remote Code Execution attack on LG Signage https://vulnogram.org/CVE-2024-1885 https://vulnogram.org/CVE-2024-1885 This vulnerability allows remote attackers to execute arbitrary code on the affected webOS of LG Signage. Medium Mon, 26 Feb 2024 07:39:43 GMT CVE-2023-44129 · 3.6 LOW — Messaging - Gaining access to arbitrary content providers via QClipIntentReceiverActivity https://vulnogram.org/CVE-2023-44129 https://vulnogram.org/CVE-2023-44129 The vulnerability is that the Messaging ("com.android.mms") app patched by LG forwards attacker-controlled intents back to the attacker in the exported "com.android.mms.ui.QClipIntentReceiverActivity" activity. The attacker can abuse this functionali… Low Wed, 27 Sep 2023 14:10:56 GMT CVE-2023-44128 · 5 MEDIUM — LGInstallService - Deletion of arbitrary files with system privilege https://vulnogram.org/CVE-2023-44128 https://vulnogram.org/CVE-2023-44128 he vulnerability is to delete arbitrary files in LGInstallService ("com.lge.lginstallservies") app. The app contains the exported "com.lge.lginstallservies.InstallService" service that exposes an AIDL interface. All its "installPackage*" methods are… Medium Wed, 27 Sep 2023 14:08:51 GMT CVE-2023-44127 · 3.6 LOW — Call management - Implicit activity intents disclose contact details and phone numbers https://vulnogram.org/CVE-2023-44127 https://vulnogram.org/CVE-2023-44127 he vulnerability is that the Call management ("com.android.server.telecom") app patched by LG launches implicit intents that disclose sensitive data to all third-party apps installed on the same device. Those intents include data such as contact deta… Low Wed, 27 Sep 2023 14:05:24 GMT CVE-2023-44126 · 3.6 LOW — Call management - Implicit intents disclose telephony data such as phone numbers, call states, contacts https://vulnogram.org/CVE-2023-44126 https://vulnogram.org/CVE-2023-44126 The vulnerability is that the Call management ("com.android.server.telecom") app patched by LG sends a lot of LG-owned implicit broadcasts that disclose sensitive data to all third-party apps installed on the same device. Those intents include data s… Low Wed, 27 Sep 2023 14:01:46 GMT CVE-2023-44125 · 6.1 MEDIUM — Personalized service - Theft and (over-)write of arbitrary files with system privilege via PendingIntent hijacking https://vulnogram.org/CVE-2023-44125 https://vulnogram.org/CVE-2023-44125 The vulnerability is the use of implicit PendingIntents without the PendingIntent.FLAG_IMMUTABLE set that leads to theft and/or (over-)write of arbitrary files with system privilege in the Personalized service ("com.lge.abba") app. The attacker's app… Medium Wed, 27 Sep 2023 13:59:02 GMT CVE-2023-44124 · 6.1 MEDIUM — Screen recording - Theft of arbitrary files with system privilege https://vulnogram.org/CVE-2023-44124 https://vulnogram.org/CVE-2023-44124 The vulnerability is to theft of arbitrary files with system privilege in the Screen recording ("com.lge.gametools.gamerecorder") app in the "com/lge/gametools/gamerecorder/settings/ProfilePreferenceFragment.java" file. The main problem is that the a… Medium Wed, 27 Sep 2023 13:55:26 GMT CVE-2023-44123 · 6.1 MEDIUM — Bluetooth - Theft and (over-)write of arbitrary files with system privilege via PendingIntent hijacking https://vulnogram.org/CVE-2023-44123 https://vulnogram.org/CVE-2023-44123 The vulnerability is the use of implicit PendingIntents with the PendingIntent.FLAG_MUTABLE set that leads to theft and/or (over-)write of arbitrary files with system privilege in the Bluetooth ("com.lge.bluetoothsetting") app. The attacker's app, if… Medium Wed, 27 Sep 2023 13:52:57 GMT CVE-2023-44122 · 6.1 MEDIUM — LockScreenSettings - Theft arbitrary files with system privilege https://vulnogram.org/CVE-2023-44122 https://vulnogram.org/CVE-2023-44122 The vulnerability is to theft of arbitrary files with system privilege in the LockScreenSettings ("com.lge.lockscreensettings") app in the "com/lge/lockscreensettings/dynamicwallpaper/MyCategoryGuideActivity.java" file. The main problem is that the a… Medium Wed, 27 Sep 2023 13:42:52 GMT CVE-2023-44121 · 5 MEDIUM — LG ThinQ Service - Intent redirection with system privilege/LaunchAnyWhere https://vulnogram.org/CVE-2023-44121 https://vulnogram.org/CVE-2023-44121 The vulnerability is an intent redirection in LG ThinQ Service ("com.lge.lms2") in the "com/lge/lms/things/ui/notification/NotificationManager.java" file. This vulnerability could be exploited by a third-party app installed on an LG device by sending… Medium Wed, 27 Sep 2023 08:36:44 GMT CVE-2023-4616 · 7.5 HIGH 🌩️ — thumbnail Directory Path Traversal Allows Unauthenticated Arbitrary File Read Vulnerability https://vulnogram.org/CVE-2023-4616 https://vulnogram.org/CVE-2023-4616 This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/thumbnail endpoint. The… High Network Exploitable Mon, 04 Sep 2023 10:42:14 GMT CVE-2023-4615 · 7.5 HIGH 🌩️ — updateFile Directory Path Traversal Allows Unauthenticated Arbitrary File Read Vulnerability https://vulnogram.org/CVE-2023-4615 https://vulnogram.org/CVE-2023-4615 This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/download/updateFile end… High Network Exploitable Mon, 04 Sep 2023 10:39:30 GMT CVE-2023-4614 · 9.8 CRITICAL 🌩️ — setThumbnailRC Directory Path Traversal Allows Unauthenticated Arbitrary File Read Vulnerability https://vulnogram.org/CVE-2023-4614 https://vulnogram.org/CVE-2023-4614 This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/installation/setThumbnailRc end… Critical Network Exploitable Mon, 04 Sep 2023 10:33:28 GMT CVE-2023-4613 · 9.8 CRITICAL 🌩️ — Upload Directory Path Traversal Allows Unauthenticated Arbitrary File Read Vulnerability https://vulnogram.org/CVE-2023-4613 https://vulnogram.org/CVE-2023-4613 This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/settings/upload endpoint. The i… Critical Network Exploitable Mon, 04 Sep 2023 08:16:27 GMT CVE-2022-45422 · 7.8 HIGH https://vulnogram.org/CVE-2022-45422 https://vulnogram.org/CVE-2022-45422 When LG SmartShare is installed, local privilege escalation is possible through DLL Hijacking attack. The LG ID is LVE-HOT-220005. High Mon, 21 Nov 2022 00:00:00 GMT CVE-2022-23731 https://vulnogram.org/CVE-2022-23731 https://vulnogram.org/CVE-2022-23731 V8 javascript engine (heap vulnerability) can cause privilege escalation ,which can impact on some webOS TV models. Fri, 11 Mar 2022 17:54:11 GMT CVE-2022-23730 https://vulnogram.org/CVE-2022-23730 https://vulnogram.org/CVE-2022-23730 The public API error causes for the attacker to be able to bypass API access control. Fri, 11 Mar 2022 17:54:10 GMT CVE-2022-23729 https://vulnogram.org/CVE-2022-23729 https://vulnogram.org/CVE-2022-23729 When the device is in factory state, it can be access the shell without adb authentication process. The LG ID is LVE-SMP-210010. Fri, 04 Mar 2022 15:51:14 GMT CVE-2022-23727 https://vulnogram.org/CVE-2022-23727 https://vulnogram.org/CVE-2022-23727 There is a privilege escalation vulnerability in some webOS TVs. Due to wrong setting environments, local attacker is able to perform specific operation to exploit this vulnerability. Exploitation may cause the attacker to obtain a higher privilege Fri, 28 Jan 2022 19:09:30 GMT CVE-2022-23728 https://vulnogram.org/CVE-2022-23728 https://vulnogram.org/CVE-2022-23728 Attacker can reset the device with AT Command in the process of rebooting the device. The LG ID is LVE-SMP-210011. Fri, 21 Jan 2022 18:17:30 GMT