CveMateVulnerability intelligence

Lg Electronics vulnerabilities

25 vulnerabilities

Known vulnerabilities in Lg Electronics products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 12 products.

Products

12

LG V60 Thin Q 5G(Lmv600Vm)9 vulnerabilities
LG LED Assistant4 vulnerabilities
Supersign CMS3 vulnerabilities
LG LED Assistant2 vulnerabilities
LG Signage2 vulnerabilities
AC Smart II1 vulnerabilities
Lg Mobile Phone1 vulnerabilities
LG Supersign CMS1 vulnerabilities
(Lgpcsuite Setup), (Ipsfullhd, LG Ultrawide, Ultra HD Driver Setup)1 vulnerabilities
Smartshare1 vulnerabilities
Chocolate Kg8000 vulnerabilities
Lg Mobile Handset0 vulnerabilities

CVE-2025-10204lg electronicsac smart ii1y ago14-09-2025 12:43

A vulnerability has been discovered in AC Smart II where passwords can be changed without authorization. This page contains a hidden form for resetting the administrator password. The attacker can manipulate the page using developer tools to display and use the form. This form allows you to change the administrator password without verifying login status or user permissions.CVE-2020-7807lg electronics(lgpcsuite_setup), (ipsfullhd, lg_ultrawide, ultra_hd_driver setup)+46y ago14-09-2020 11:55

A vulnerability that can hijack a DLL file that is loaded during products(LGPCSuite_Setup, IPSFULLHD, LG_ULTRAWIDE, ULTRA_HD_Driver Setup) installation into a DLL file that the hacker wants. Missing Support for Integrity Check vulnerability in ____COMPONENT____ of LG Electronics (LGPCSuite_Setup), (IPSFULLHD, LG_ULTRAWIDE, ULTRA_HD_Driver Setup) allows ____ATTACKER/ATTACK____ to cause ____IMPACT____. This issue affects: LG Electronics; LGPCSuite_Setup : 1.0.0.3 on Windows(x86, x64); IPSFULLHD, LG_ULTRAWIDE, ULTRA_HD_Driver Setup : 1.0.0.9 on Windows(x86, x64).CVE-2005-1132lg_electronicslg_mobile_phone21y ago16-04-2005 04:00

LG U8120 mobile phone allows remote attackers to cause a denial of service (device crash) via a malformed MIDI file.CVE-2024-2862lg electronicslg led assistant+12y ago25-03-2024 06:31

This vulnerability allows remote attackers to reset the password of anonymous users without authorization on the affected LG LED Assistant.CVE-2024-2863lg electronicslg led assistant+12y ago25-03-2024 06:39

This vulnerability allows remote attackers to traverse paths via file upload on the affected LG LED Assistant.CVE-2024-1886lg electronicslg signage+12y ago26-02-2024 07:53

This vulnerability allows remote attackers to traverse the directory on the affected webOS of LG Signage.CVE-2024-1885lg electronicslg signage+12y ago26-02-2024 07:39

This vulnerability allows remote attackers to execute arbitrary code on the affected webOS of LG Signage.CVE-2024-6177lg electronicssupersign cms+12y ago20-06-2024 00:52

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in LG Electronics SuperSign CMS allows Reflected XSS. This issue affects SuperSign CMS: from 4.1.3 before < 4.3.1.CVE-2024-6176lg electronicslg supersign cms2y ago20-06-2024 00:44

Allocation of Resources Without Limits or Throttling vulnerability in LG Electronics LG SuperSign CMS allows Port Scanning.This issue affects LG SuperSign CMS: from 4.1.3 before < 4.3.1.CVE-2024-6179lg electronicssupersign cms+12y ago20-06-2024 01:53

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LG Electronics SuperSign CMS allows Reflected XSS. This issue affects SuperSign CMS: from 4.1.3 before < 4.3.1.CVE-2024-6178lg electronicssupersign cms+12y ago20-06-2024 01:51

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LG Electronics SuperSign CMS allows Reflected XSS. This issue affects SuperSign CMS: from 4.1.3 before < 4.3.1.CVE-2026-15929lg electronicssmartshare2mo ago30-07-2026 01:50

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in LG Electronics SmartShare allows SQL Injection. This issue affects SmartShare: through 2.3.1712.1202, which is supported on Microsoft Windows 10 and earlier versions.CVE-2023-4613lg electronicslg-led assistant+13y ago04-09-2023 08:16

This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/settings/upload endpoint. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user.CVE-2023-4616lg electronicslg-led assistant+13y ago04-09-2023 10:42

This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/thumbnail endpoint. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of the current user.CVE-2023-4614lg electronicslg-led assistant+13y ago04-09-2023 10:33

This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/installation/setThumbnailRc endpoint. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user.CVE-2023-4615lg electronicslg-led assistant+13y ago04-09-2023 10:39

This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/download/updateFile endpoint. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of the current user.CVE-2023-44126googleandroid+13y ago27-09-2023 14:01

The vulnerability is that the Call management ("com.android.server.telecom") app patched by LG sends a lot of LG-owned implicit broadcasts that disclose sensitive data to all third-party apps installed on the same device. Those intents include data such as call states, durations, called numbers, contacts info, etc.CVE-2023-44129googleandroid+13y ago27-09-2023 14:10

The vulnerability is that the Messaging ("com.android.mms") app patched by LG forwards attacker-controlled intents back to the attacker in the exported "com.android.mms.ui.QClipIntentReceiverActivity" activity. The attacker can abuse this functionality by launching this activity and then sending a broadcast with the "com.lge.message.action.QCLIP" action. The attacker can send, e.g., their own data/clipdata and set Intent.FLAG_GRANT_* flags. After the attacker received that intent in the "onActivityResult()" method, they would have access to arbitrary content providers that have the `android:grantUriPermissions="true"` flag set.CVE-2023-44127googleandroid+13y ago27-09-2023 14:05

he vulnerability is that the Call management ("com.android.server.telecom") app patched by LG launches implicit intents that disclose sensitive data to all third-party apps installed on the same device. Those intents include data such as contact details and phone numbers.CVE-2023-44123googleandroid+13y ago27-09-2023 13:52

The vulnerability is the use of implicit PendingIntents with the PendingIntent.FLAG_MUTABLE set that leads to theft and/or (over-)write of arbitrary files with system privilege in the Bluetooth ("com.lge.bluetoothsetting") app. The attacker's app, if it had access to app notifications, could intercept them and redirect them to its activity, before making it grant access permissions to content providers with the `android:grantUriPermissions="true"` flag.