Gamers Nexus teardown finds LG TVs inventorying the LAN they sit on
A Gamers Nexus and Level1Techs teardown shows LG smart TVs surveying the networks they join, which makes the lobby panel and the exec's home-office set part of your asset problem rather than someone's privacy complaint.
The Watch · Security desk
What happened
- Gamers Nexus worked with Level1Techs' Wendell and researchers Mr. Bruh and U-Turn to root LG test televisions, decrypt and decompile the firmware, and capture network traffic with Wireshark.
- The televisions repeatedly scanned the local network and detected dozens of unrelated devices, logging device names, MAC addresses, internal IP addresses and signal strength.
- Automatic content recognition kept running in some configurations even when the set was being used primarily as an HDMI display for another source.
- One rooted LG G5 kept recording audio locally after its network cable was pulled, and the researchers collected the stored audio once connectivity came back.
- The team reported remote-code-execution vulnerabilities to LG and is withholding technical detail while responsible disclosure runs.
Why it matters
- Who's exposed exposure A lobby screen or an executive's home-office panel on a production segment is a host performing discovery for a third party, and Malwarebytes notes a compromised set also offers a foothold and a route to probe neighbours.
- What it limits constraint With the remote-code-execution bugs unpublished, there is no CVE to track and no patch to schedule, so this lands on whoever owns VLANs and cabling rather than on the patch window.
- Who has to decide decision Buying a smart set and using it as a plain display no longer counts as a mitigation, which pushes the choice back to whether the television gets network credentials at all.
- What it sets up precedent Texas already extracted a settlement from Samsung over ACR-based viewing data, so firmware-level evidence of the same collection at LG gives the next attorney general a shorter path to a complaint.
Next story · Build · 9h ago
Zenity Labs: one prompt to a public AgentCore agent could return temporary credentials tied to a default role not scoped to that agentConfirmed3 publishers
This scanning is part of how the product normally operates, not evidence of exploitation. Among the device classes the rooted sets identified were smartwatches, network switches, printers, 3D printers, servers and HVAC hardware [3], and firmware analysis showed the television could also survey nearby Wi-Fi networks, logging names, signal strength and channel [4]. In an office, that inventory describes a floor rather than a living room.
Where traffic goes is documented separately. One test set connected to numerous LG and advertising endpoints and repeatedly contacted the ACR infrastructure of Alphonso [14], the entity LG's advertising business operates through after LG took a controlling stake in 2021 [18]. Gamers Nexus estimated roughly 4GB of ACR-related data a month from a single television [15]. That is 48GB a year per panel, or 480GB a year from a ten-screen estate of lobby and meeting-room displays [23]. LG Channels requests could also reveal which channel was being watched [20].
Neither Gamers Nexus nor Malwarebytes reports having observed the LAN device inventory itself leaving the set. Malwarebytes describes that data as information that could help build a picture of the devices in a household and, combined with ACR data and advertising IDs, support detailed profiles [22]. So the discovery and the ACR egress are each documented; the link between them is inference at this stage.
The audio findings sit on the other side of the line. After taking control of test units, the researchers recorded through built-in microphones, USB webcams and remote-control microphones [5], and Malwarebytes reports capture continuing when the television appeared to be off [8]. One demonstration pulled the audio of a conference call passing through the television off the television itself [7]. Gamers Nexus frames this as what an attacker inherits after compromise, not as evidence that LG records private conversations [11].
That leaves placement. The researchers involved recommend disconnecting LG smart TVs from networks while the undisclosed vulnerabilities move through responsible disclosure [16], and isolating sets from sensitive home or business systems [12]. Malwarebytes recommends a separate IoT or guest network for televisions and turning UPnP off at the router [10]. For a boardroom panel or an executive's home office, the practical version of that advice is a VLAN the television cannot route out of.
Malwarebytes splits the findings into two categories: some concern LG's intended product behaviour, and others depend on vulnerabilities still under disclosure [19], and the product-behaviour category will still be there once LG fixes the second.
What to watch
- Whether LG's fixes for the reported remote-code-execution bugs ship with CVEs and a named list of affected model years.
- Whether any researcher captures the LAN device inventory in transit to LG or Alphonso endpoints, which would close the gap between discovery and exfiltration.
- Whether a state attorney general opens an ACR case against LG on the pattern of the Texas action against Samsung.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence60
- Adoption45
- Hype gap+18
- Incentives55
- Confidence58
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
For the investigation, Gamers Nexus partnered with researchers Mr. Bruh, U-Turn, and Wendell from Level1Techs; the team analyzed network traffic with Wireshark, decrypted and decompiled LG firmware, rooted test televisions, and inspected system processes and logs.
- [2]
During testing the LG TVs repeatedly scanned the local area network and detected dozens of unrelated devices; collected information included device names, MAC addresses, signal strength, internal IP addresses and other attributes.
- [3]
The tested TVs identified smartphones, PCs, smartwatches, network switches, printers, 3D printers, servers and HVAC-related devices.
- [4]
Firmware analysis showed that nearby Wi-Fi networks could be detected, including their names, signal strength and channel information.
- [5]
After gaining control of test units, researchers demonstrated recording through built-in microphones, USB webcams, remote-control microphones and other audio sources.
- [6]
In one demonstration an LG G5 continued recording locally after its network connection was removed, and the audio was retrieved after connectivity was restored.
- [7]
The team showed that audio from a conference call passing through the TV could be captured from the television itself.
- [8]
Malwarebytes reports the researchers demonstrated a compromised TV capturing audio through its microphone, including when the TV appeared to be off.
- [9]
The researchers reported remote-code-execution vulnerabilities to LG and have not disclosed full details while the responsible disclosure process is ongoing.
- [10]
Malwarebytes recommends using a separate IoT or guest network for televisions and other smart-home devices, and disabling UPnP on the router unless genuinely needed.
- [11]
The demonstrations do not establish that LG is secretly recording private conversations; they show that hardware and software capabilities in the TVs could be abused by an attacker after compromise.
- [12]
The investigation recommends disabling ACR and advertising tracking where possible, reviewing voice-control settings, avoiding unnecessary microphones or webcams, and isolating smart TVs from sensitive home or business systems.
- [13]
Gamers Nexus said ACR remained active in some configurations even when a TV was being used primarily as an HDMI display.
- [14]
In one test, a TV connected to numerous LG and advertising-related endpoints and repeatedly contacted Alphonso's ACR infrastructure.
- [15]
The researchers estimated that one television could exchange roughly 4GB of ACR-related data per month.
- [16]
Researchers involved in the investigation recommended disconnecting LG smart TVs from networks while undisclosed vulnerabilities go through responsible disclosure.
- [17]
Malwarebytes previously reported on Samsung settling a lawsuit with the Texas Attorney General over how its smart TVs collect and monetize viewing data using Automated Content Recognition.
- [18]
LG's advertising business operates through LG Ad Solutions, incorporated as Alphonso Inc.; LG acquired a controlling stake in Alphonso in 2021 to expand its connected-TV advertising and analytics business.
- [19]
Malwarebytes says some findings concern LG's intended product behaviour while others rely on vulnerabilities researchers say are still being disclosed responsibly.
- [20]
LG Channels activity generated network requests that could reveal which channel was being watched.
- [21]
Malwarebytes says a compromised television could give an attacker a foothold on a home or business network, access to audio, or a route to probe other devices.
- [22]
Malwarebytes says the network information could help build a picture of the other devices in a household and, combined with ACR data, advertising IDs and other information, could support detailed profiles of what people watch and the devices they use.
- [23]
At roughly 4GB of ACR-related data per month, one LG television accounts for about 48GB a year, and a ten-screen deployment about 480GB a year.
Sources
2 independent publishers whose own reporting we read for this story.
- cyberinsider.comLG Smart TVs found scanning home networks for nearby devices
1 article · September 7, 2026
- malwarebytes.comLG TV flaws could let attackers listen in, even in standby mode
1 article · September 7, 2026
Topics and entities
Topics
- Smart TV privacy
- Coordinated Vulnerability Disclosure
- Firmware Reverse Engineering
- Connected TV advertising
- IoT network segmentation
Entities
- Texas Attorney General
- Samsung Electronics
- Automated Content Recognition
- Wireshark
- Malwarebytes
- LG Electronics