Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in LG Electronics SuperSign CMS allows Reflected XSS. This issue affects SuperSign CMS: from 4.1.3 before < 4.3.1.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LG Electronics SuperSign CMS allows Reflected XSS. This issue affects SuperSign CMS: from 4.1.3 before < 4.3.1.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LG Electronics SuperSign CMS allows Reflected XSS. This issue affects SuperSign CMS: from 4.1.3 before < 4.3.1.

This vulnerability allows remote attackers to execute arbitrary code on the affected webOS of LG Signage.

This vulnerability allows remote attackers to traverse the directory on the affected webOS of LG Signage.

When LG SmartShare is installed, local privilege escalation is possible through DLL Hijacking attack. The LG ID is LVE-HOT-220005.

Network Attached Storage on LG N1T1 10124 devices allows an unauthenticated attacker to gain root access via OS command injection in the en/ajp/plugins/access.ssh/checkInstall.php destServer parameter.

A Vulnerability of LG Electronic web OS TV Emulator could allow an attacker to escalate privileges and overwrite certain files. This vulnerability is due to wrong environment setting. An attacker could exploit this vulnerability through crafted configuration files and executable files.

LG N1A1 NAS 3718.510 is affected by: Remote Command Execution. The impact is: execute arbitrary code (remote). The attack vector is: HTTP POST with parameters.

An issue was discovered on LG devices using the MTK chipset with L(5.0/5.1), M(6.0/6.0.1), and N(7.0) software, and RCA Voyager Tablet, BLU Advance 5.0, and BLU R1 HD devices. The MTKLogger app with a package name of com.mediatek.mtklogger has application components that are accessible to any application that resides on the device. Namely, the com.mediatek.mtklogger.framework.LogReceiver and com.mediatek.mtklogger.framework.MTKLoggerService application components are exported since they contain an intent filter, are not protected by a custom permission, and do not explicitly set the android:exported attribute to false. Therefore, these components are exported by default and are thus accessible to any third party application by using android.content.Intent object for communication. These application components can be used to start and stop the logs using Intent objects with embedded data. The available logs are the GPS log, modem log, network log, and mobile log. The base directory that contains the directories for the 4 types of logs is /sdcard/mtklog which makes them accessible to apps that require the READEXTERNALSTORAGE permission. The GPS log contains the GPS coordinates of the user as well as a timestamp for the coordinates. The modem log contains AT commands and their parameters which allow the user's outgoing and incoming calls and text messages to be obtained. The network log is a tcpdump network capture. The mobile log contains the Android log, which is not available to third-party apps as of Android 4.1. The LG ID is LVE-SMP-160019.

LG SuperSign Media Editor getSubFolderList Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG SuperSign Media Editor. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the getSubFolderList method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-20330.

LG SuperSign Media Editor ContentRestController getObject Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG SuperSign Media Editor. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the getObject method implemented in the ContentRestController class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-20328.

Host Rich Stroffolino will be chatting with our guest, Derek Fisher, Director of the Cyber Defense and Information Assurance Program, Temple University about some of the biggest stories in cybersecurity this past week. You are invited to watch and participate in the live discussion.

We go to air at 12:30pm PT/3:30pm ET. Just go to YouTube Live here https://youtube.com/live/Zb2Oe9WaAKY or you can subscribe to the Cyber Security Headlines podcast and get it into your feed.

Here are the stories we plan to cover:

Unpatched flaw in LG surveillance cameras allows admin access CISA is warning of an unpatched authentication bypass vulnerability in a specific model of security camera – the type often mounted on ceilings in commercial buildings. The model number (LG LNV5110R) and CVE number (CVE-2025-7742) are listed in this episode’s show notes. Approximately 1,300 cameras are active and vulnerable to full unauthenticated RCE, allowing remote takeover and network pivoting. As CISA points out, this is a critical infrastructure threat, which is not just simply a risk to isolated devices, but potentially endangers facilities that are vital to public safety and national operations. “The manufacturer, LG Innotek is aware of the vulnerability, but it will not patch it because this particular camera model is an end-of-life product. (Security Affairs)

Microsoft cannot guarantee data sovereignty Speaking under oath in the French Senate, executives from Microsoft France said their company cannot guarantee data sovereignty to customers in France, and by extension to the wider European Union – due to the Cloud Act, a law that “gives the U.S. government authority to obtain digital data held by U.S.-based tech corporations irrespective of whether that data is stored on servers at home or on foreign soil. It is said to compel these companies, via warrant or subpoena, to accept the request.” The issue of access to data, and the enforceability of provisions of the Cloud ACT will require a great deal of litigation, especially considering, as AWS – who supported the bill, along with Microsoft and Google – stated, is that “the Cloud Act does not only apply to U.S. headquartered companies, it is applicable to all “electronic communication service or remote computing service providers” that do business stateside. (The Register)

French submarine secrets surface after cyber attack Hackers calling themselves Neferpitou have leaked 13 gigabytes of internal documents belonging to French submarine manufacturer Naval Group, everything from combat system source code and simulation software to weapons configurations and internal communications. They claim to have up to a terabyte of stolen data, and the leaked materials appear both legitimate and highly sensitive. Naval Group says it has found no evidence of a breach in its internal systems, no confirmed intrusion, no operational disruption. But somehow, its proprietary data is now circulating online. French authorities and cybersecurity experts are investigating, though the company is currently treating the event as a reputational attack rather than a verified compromise. Neferpitou hasn’t explained how they got the data, offered no ransom demand, and issued only a cryptic 72-hour ultimatum followed by the message: “ENJOY AND SEE YOU NEXT TIME.” The data is real, but the path it took to get out is still a mystery. (Bitdefender)

FBI, CISA warn about Scattered Spider’s evolving tactics The FBI and CISA issued an updated advisory warning that Scattered Spider remains a serious threat, using sophisticated social engineering and intrusion tactics including phishing, MFA fatigue, SIM-swapping, and ransomware like Dragonforce to breach systems, including encrypting VMWare ESXi servers. Despite recent arrests tied to the gang, U.S., U.K., Canadian, and Australian authorities emphasized that Scattered Spider’s evolving techniques continue to pose a big risk to national security and critical infrastructure. (Cybersecurity Dive) (CISA.gov)

Supply Chain Attacks Spotted in GitHub Actions, Gravity Forms, npm Researchers at Armis Labs uncovered major software supply chain attacks in GitHub Actions, the UAParser.js npm package, and the Gravity Forms WordPress plugin, all involving backdoors or poisoned code that jeopardized thousands of systems. These incidents remind us how trusted developer tools can be compromised, and how AI-driven coding practices are being exploited. Experts warn that attackers can now backdoor vast numbers of software projects in days, making early detection and code integrity checks more critical than ever. (Dark Reading)

ATM network breached and attacked through 4G Raspberry Pi This activity is being attributed to a financially motivated threat actor known as UNC2891. According to security firm Group-IB, this attack did require physical access in order to install the Raspberry Pi device and then connect it to the same network switch as the ATM, thus effectively joining the network. It is “currently not known how this access was obtained.” The scheme used a kernel module rootkit dubbed CAKETAP, which was “designed to hide network connections, processes, and files, as well as intercept and spoof card and PIN verification messages from hardware security modules (HSMs) to enable financial fraud.” Although the specific network, country or victim organization is not identified in the media or in the report from Group IB, the emphasis is on the physical penetration of the network which used “Linux bind mounts to hide backdoor processes from conventional detection tools.” As a consequence, “standard forensic triage failed to reveal the backdoor because the attacker leveraged a technique that had not been documented in public threat reports at the time.” (The Hacker News and Group IB report)

Kremlin monitors foreign embassies in Moscow at ISP level According to researchers at Microsoft, the Russian government is “monitoring foreign embassies in Moscow by installing malware through its control of local internet service providers (ISPs).” This campaign, which has been in operation since last year, is known by Microsoft as Secret Blizzard, but this is the first time it has been able to confirm that Secret Blizzard, also tracked as Turla, has the capability to conduct espionage activities at the ISP level. “In a blog post on Thursday, Microsoft said it first saw the spies using an adversary-in-the-middle (AiTM) technique to deploy the ApolloShadow malware against foreign embassies in February 2025 — allowing them to collect intelligence from diplomatic entities and maintain access to systems.” (The Record)

LG Simple Editor deleteCheckSession Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the deleteCheckSession method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete files in the context of SYSTEM. . Was ZDI-CAN-19919.

This vulnerability allows remote attackers to traverse paths via file upload on the affected LG LED Assistant.

LG Simple Editor copySessionFolder Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the implementation of the copySessionFolder command. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. . Was ZDI-CAN-19920.

LG Simple Editor deleteFolder Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the deleteFolder method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete files in the context of SYSTEM. . Was ZDI-CAN-19921.

LG Simple Editor copyTemplateAll Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the copyTemplateAll method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. . Was ZDI-CAN-19922.

This vulnerability allows remote attackers to reset the password of anonymous users without authorization on the affected LG LED Assistant.

A prompt bypass exists in the secondscreen.gateway service running on webOS version 4 through 7. An attacker can create a privileged account without asking the user for the security PIN.

Full versions and TV models affected:

webOS 4.9.7 - 5.30.40 running on LG43UM7000PLA webOS 5.5.0 - 04.50.51 running on OLED55CXPUA webOS 6.3.3-442 (kisscurl-kinglake) - 03.36.50 running on OLED48C1PUB   webOS 7.3.1-43 (mullet-mebin) - 03.33.85 running on OLED55A23LA

A command injection vulnerability exists in the processAnalyticsReport method from the com.webos.service.cloudupload service on webOS version 5 through 7. A series of specially crafted requests can lead to command execution as the root user. An attacker can make authenticated requests to trigger this vulnerability.

Full versions and TV models affected:

webOS 5.5.0 - 04.50.51 running on OLED55CXPUA

webOS 6.3.3-442 (kisscurl-kinglake) - 03.36.50 running on OLED48C1PUB

webOS 7.3.1-43 (mullet-mebin) - 03.33.85 running on OLED55A23LA

A command injection vulnerability exists in the getAudioMetadata method from the com.webos.service.attachedstoragemanager service on webOS version 4 through 7. A series of specially crafted requests can lead to command execution as the root user. An attacker can make authenticated requests to trigger this vulnerability.

webOS 4.9.7 - 5.30.40 running on LG43UM7000PLA

webOS 5.5.0 - 04.50.51 running on OLED55CXPUA

webOS 6.3.3-442 (kisscurl-kinglake) - 03.36.50 running on OLED48C1PUB

webOS 7.3.1-43 (mullet-mebin) - 03.33.85 running on OLED55A23LA

A command injection vulnerability exists in the com.webos.service.connectionmanager/tv/setVlanStaticAddress endpoint on webOS versions 5 and 6. A series of specially crafted requests can lead to command execution as the dbus user. An attacker can make authenticated requests to trigger this vulnerability.

Full versions and TV models affected: webOS 5.5.0 - 04.50.51 running on OLED55CXPUA

webOS 6.3.3-442 (kisscurl-kinglake) - 03.36.50 running on OLED48C1PUB

This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/download/updateFile endpoint. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of the current user.

This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/thumbnail endpoint. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of the current user.

This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/settings/upload endpoint. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user.

This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/installation/setThumbnailRc endpoint. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user.

The LHA.sys driver before 1.1.1811.2101 in LG Device Manager exposes functionality that allows low-privileged users to read and write arbitrary physical memory via specially crafted IOCTL requests and elevate system privileges. This occurs because the device object has an associated symbolic link and an open DACL.

The vulnerability is an intent redirection in LG ThinQ Service ("com.lge.lms2") in the "com/lge/lms/things/ui/notification/NotificationManager.java" file. This vulnerability could be exploited by a third-party app installed on an LG device by sending a broadcast with the action "com.lge.lms.things.notification.ACTION". Additionally, this vulnerability is very dangerous because LG ThinQ Service is a system app (having android:sharedUserId="android.uid.system" setting). Intent redirection in this app leads to accessing arbitrary not exported activities of absolutely all apps.

The vulnerability is that the Messaging ("com.android.mms") app patched by LG forwards attacker-controlled intents back to the attacker in the exported "com.android.mms.ui.QClipIntentReceiverActivity" activity. The attacker can abuse this functionality by launching this activity and then sending a broadcast with the "com.lge.message.action.QCLIP" action. The attacker can send, e.g., their own data/clipdata and set Intent.FLAGGRANT flags. After the attacker received that intent in the "onActivityResult()" method, they would have access to arbitrary content providers that have the android:grantUriPermissions="true" flag set.