High severity · published Mar 23, 2020
CVE-2020-9759
A Vulnerability of LG Electronic web OS TV Emulator could allow an attacker to escalate privileges and overwrite certain files
7.8
CVSS
0.5%
EPSS
No
On KEV
Description
A Vulnerability of LG Electronic web OS TV Emulator could allow an attacker to escalate privileges and overwrite certain files. This vulnerability is due to wrong environment setting. An attacker could exploit this vulnerability through crafted configuration files and executable files.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
Webos · LG
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-9759
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-9759
Exploit
https://blog.recurity-labs.com/2021-02-03/webOS_Pt1.html
Mailing List
https://lists.debian.org/debian-lts-announce/2021/09/msg00018.html
More from Webos
9.8
CVE-2023-6317
A prompt bypass exists in the secondscreen.gateway service running on webOS version 4 through 7
9.8
CVE-2022-23730
The public API error causes for the attacker to be able to bypass API access control
7.8
CVE-2022-23731
V8 javascript engine (heap vulnerability) can cause privilege escalation ,which can impact on some webOS TV models
7.8
CVE-2022-23727
There is a privilege escalation vulnerability in some webOS TVs
7.2
CVE-2023-6320
A command injection vulnerability exists in the com.webos.service.connectionmanager/tv/setVlanStaticAddress endpoint on webOS versions 5 and 6