CVE-2023-6320
CVSS V2 None
CVSS V3 None
Description
A command injection vulnerability exists in the com.webos.service.connectionmanager/tv/setVlanStaticAddress endpoint on webOS versions 5 and 6. A series of specially crafted requests can lead to command execution as the dbus user. An attacker can make authenticated requests to trigger this vulnerability.
Full versions and TV models affected:
* webOS 5.5.0 - 04.50.51 running on OLED55CXPUA
* webOS 6.3.3-442 (kisscurl-kinglake) - 03.36.50 running on OLED48C1PUB
Overview
- CVE ID
- CVE-2023-6320
- Assigner
- Bitdefender
- Vulnerability Status
- PUBLISHED
- Published Version
- 2024-04-09T13:43:35.166Z
- Last Modified Date
- 2024-06-20T15:40:09.500Z
Weakness Enumerations
References
| Reference URL | Reference Tags |
|---|---|
| https://bitdefender.com/blog/labs/vulnerabilities-identified-in-lg-webos/ | |
| https://lgsecurity.lge.com/bulletins/tv#updateDetails | vendor-advisory |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2023-6320 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6320 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2024-06-25 06:16:29 | Added to TrackCVE |