9.8

CVE-2023-6317

Exploit

A prompt bypass exists in the secondscreen.gateway service running on webOS version 4 through 7. An attacker can create a privileged account without asking the user for the security PIN. 

Full versions and TV models affected:

webOS 4.9.7 - 5.30.40 running on LG43UM7000PLA 
webOS 5.5.0 - 04.50.51 running on OLED55CXPUA 
webOS 6.3.3-442 (kisscurl-kinglake) - 03.36.50 running on OLED48C1PUB  
webOS 7.3.1-43 (mullet-mebin) - 03.33.85 running on OLED55A23LA

Data is provided by the National Vulnerability Database (NVD)
Lg ≫ Webos Version4.9.7
   Lg ≫ Lg43um7000pla Version-
Lg ≫ Webos Version5.5.0
   Lg ≫ Oled55cxpua Version-
Lg ≫ Webos Version6.3.3-442
   Lg ≫ Oled48c1pub Version-
Lg ≫ Webos Version7.3.1-43
   Lg ≫ Oled55a23la Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.1% 0.286
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cve-requests@bitdefender.com 7.2 3.9 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CWE-639 Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.