Which versions of LG SmartShare are affected by EUVD-2026-50947?

LG Electronics SmartShare through version 2.3.1712.1202 contains a SQL injection vulnerability accessible from adjacent networks that could expose sensitive application data without requiring user…

How to fix or mitigate EUVD-2026-50947?

Within 24 hours, audit all systems running LG SmartShare 2.3.1712.1202 or earlier to identify those exposed to adjacent networks and map their dependencies. Within 7 days, implement network segmentation via VLAN isolation or host-based firewalls to restrict SmartShare system access strictly to authorized internal systems, and enable comprehensive database query logging to monitor for SQL injection attack patterns. Within 30 days, establish regular monitoring of LG security advisories through product.security@lge.com, create a vendor patch engagement plan with defined SLAs, and develop a technical remediation strategy including SmartShare version upgrades or replacement with alternative solutions once patches become available.

LG SmartShare EUVD-2026-50947

Q: What is the CVSS score of EUVD-2026-50947?

EUVD-2026-50947 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-15929 HIGH

SQL Injection (CWE-89)

2026-07-30 product.security@lge.com

GHSA-g2xh-vghf-6g4h

SQLi Microsoft

7.1

CVSS 4.0 · Vendor: lge

Severity by source

Vendor (lge) PRIMARY

7.1 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.1 HIGH

Adjacent network reachable service (AV:A), no auth or interaction (PR:N/UI:N); SQLi primarily discloses data (C:H) with minor integrity impact (I:L) and no availability loss.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (lge).

CVSS VectorVendor: lge

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 02:30 vuln.today

CVE Published

Jul 30, 2026 - 02:16 cve.org

HIGH 7.1

DescriptionCVE.org

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in LG Electronics SmartShare allows SQL Injection.

This issue affects SmartShare: through 2.3.1712.1202, which is supported on Microsoft Windows 10 and earlier versions.

AnalysisAI

SQL injection in LG Electronics SmartShare (all versions through 2.3.1712.1202 on Windows 10 and earlier) lets an adjacent-network attacker inject crafted SQL into the application's database queries, primarily exposing sensitive data (CVSS 4.0 base 7.1, VC:H). The flaw was reported by LG's own product security team (product.security@lge.com) and requires no authentication or user interaction, but is constrained to the local/adjacent network. No public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

SmartShare is LG's DLNA/media-sharing client-server application for Windows that indexes and shares media libraries across a home or local network. The root cause is CWE-89 (improper neutralization of special elements in an SQL command): user- or network-supplied input reaches a backend SQL query without proper parameterization or escaping, allowing the query structure to be altered. Because SmartShare exposes network-facing services to share media, an attacker on the same broadcast/adjacent network segment (consistent with the CVSS AV:A metric) can reach the vulnerable interface and manipulate its underlying database - typically a local embedded store used for the media catalog and application metadata.

RemediationAI

Patch available per vendor advisory: consult the LG PC security bulletin at https://lgsecurity.lge.com/bulletins/pc for the fixed SmartShare release and update SmartShare to the latest available version, as builds through 2.3.1712.1202 are affected; an exact fixed version number is not stated in the provided data and should be confirmed from the LG bulletin. As compensating controls where immediate patching is not possible, restrict SmartShare's network exposure by blocking its listening ports at the Windows Firewall or host firewall so only trusted hosts can reach it (side effect: media sharing to legitimate DLNA clients will break), avoid running SmartShare on untrusted or shared networks such as public/guest Wi-Fi, and uninstall SmartShare on systems that do not require media sharing (side effect: loss of the media-sharing feature). Segmenting the host onto a trusted VLAN reduces the adjacent-network attack surface without disabling the application.