CVE-2023-6319
Severity CVSS v4.0:
Pending analysis
Type:
CWE-78
OS Command Injections
Publication date:
09/04/2024
Last modified:
07/02/2025
Description
A command injection vulnerability exists in the getAudioMetadata method from the com.webos.service.attachedstoragemanager service on webOS version 4 through 7. A series of specially crafted requests can lead to command execution as the root user. An attacker can make authenticated requests to trigger this vulnerability.<br />
<br />
* webOS 4.9.7 - 5.30.40 running on LG43UM7000PLA <br />
<br />
* webOS 5.5.0 - 04.50.51 running on OLED55CXPUA <br />
<br />
* webOS 6.3.3-442 (kisscurl-kinglake) - 03.36.50 running on OLED48C1PUB <br />
<br />
* webOS 7.3.1-43 (mullet-mebin) - 03.33.85 running on OLED55A23LA<br />
<br />
Impact
Base Score 3.x
9.10
Severity 3.x
CRITICAL
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:lg:webos:4.9.7:*:*:*:*:*:*:* | ||
| cpe:2.3:h:lg:lg43um7000pla:-:*:*:*:*:*:*:* | ||
| cpe:2.3:o:lg:webos:5.5.0:*:*:*:*:*:*:* | ||
| cpe:2.3:h:lg:oled55cxpua:-:*:*:*:*:*:*:* | ||
| cpe:2.3:o:lg:webos:6.3.3-442:*:*:*:*:*:*:* | ||
| cpe:2.3:h:lg:oled48c1pub:-:*:*:*:*:*:*:* | ||
| cpe:2.3:o:lg:webos:7.3.1-43:*:*:*:*:*:*:* | ||
| cpe:2.3:h:lg:oled55a23la:-:*:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page