CVE-2020-9759 webOS TV Emulator privilege escalation vulnerability
An attacker can escalate privileges and overwrite files in the LG webOS TV Emulator by exploiting incorrect environment settings via crafted configuration files.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-9759?
CVE-2020-9759 is a medium-severity vulnerability in n/a, published on 23 Mar 2020. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A Vulnerability of LG Electronic web OS TV Emulator could allow an attacker to escalate privileges and overwrite certain files. This vulnerability is due to wrong environment setting. An attacker could exploit this vulnerability through crafted configuration files and executable files.
Weakness: CWE-494
Which versions are affected by CVE-2020-9759?
It affects 1 product.
Products include Lg Webos.
How do I fix CVE-2020-9759?
Apply the vendor's patch.
Is CVE-2020-9759 being exploited?
There is no known exploitation of CVE-2020-9759 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2022-23730 Auth bypass in LG webOS TV
- CVE-2023-6318 Command injection in the processAnalyticsReport method from the com.webos.service.cloudupload service
- CVE-2023-6319 Command injection in the getAudioMetadata method from the com.webos.service.attachedstoragemanager service
- CVE-2023-6320 Command injection in the com.webos.service.connectionmanager/tv/setVlanStaticAddress endpoint
- CVE-2022-23731 Privilege escalation in LG webOS TV
Sources
Also known as DEBIAN-CVE-2020-9759, GHSA-j24f-gw9v-x4vp, UBUNTU-CVE-2020-9759.