High severity · published Jan 28, 2022
CVE-2022-23727
There is a privilege escalation vulnerability in some webOS TVs
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
There is a privilege escalation vulnerability in some webOS TVs. Due to wrong setting environments, local attacker is able to perform specific operation to exploit this vulnerability. Exploitation may cause the attacker to obtain a higher privilege
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
Webos · LG
3.0 through 5.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-23727
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-23727
Vendor Advisory
https://lgsecurity.lge.com/bulletins/tv
More from Webos
9.8
CVE-2023-6317
A prompt bypass exists in the secondscreen.gateway service running on webOS version 4 through 7
9.8
CVE-2022-23730
The public API error causes for the attacker to be able to bypass API access control
7.8
CVE-2022-23731
V8 javascript engine (heap vulnerability) can cause privilege escalation ,which can impact on some webOS TV models
7.8
CVE-2020-9759
A Vulnerability of LG Electronic web OS TV Emulator could allow an attacker to escalate privileges and overwrite certain files
7.2
CVE-2023-6320
A command injection vulnerability exists in the com.webos.service.connectionmanager/tv/setVlanStaticAddress endpoint on webOS versions 5 and 6