# LG webOS Signage code injection and path traversal flaws (CVE-2024-1885, CVE-2024-1886)

- Date: 2024-02-26
- Location: Global
- Type: Vulnerability
- Sector: Other
- CVE: CVE-2024-1885, CVE-2024-1886
- Products: [LG SuperSign](https://signagelist.org/products/lg-supersign/)

LG published two CVEs for webOS Signage 6.0.0-56 on February 26, 2024: CVE-2024-1885, a code injection flaw that can let a remote attacker run code on the device, and CVE-2024-1886, a path traversal flaw rated 8.8 by NVD. Scores vary across databases for the first one. Databases I checked report no public exploit code for either.

## Sources

- [CVE-2024-1885](https://nvd.nist.gov/vuln/detail/CVE-2024-1885) (NIST NVD)
- [CVE-2024-1886](https://nvd.nist.gov/vuln/detail/CVE-2024-1886) (NIST NVD)
- [LG product security bulletins](https://lgsecurity.lge.com/bulletins) (LG Electronics)
- [https://lgsecurity.lge.com/bulletins/idproducts#updateDetails](https://lgsecurity.lge.com/bulletins/idproducts#updateDetails)

Page: https://signagelist.org/incidents/2024-02-lg-webos-signage-code-injection-and-path/