An improper sanitization of special elements in SQL commands creates a classic SQL injection flaw, classified as CWE‑89. The flaw permits an attacker who supplies crafted input to the SmartShare application to execute arbitrary SQL statements on the underlying database. As a result, the attacker could read confidential information, alter or delete data, or potentially gain elevated privileges if the database connection has higher rights.

LG Electronics SmartShare products up through version 2.3.1712.1202 are affected. These versions run on Microsoft Windows 10 and earlier operating systems.

The CVSS score of 7.1 indicates a high severity level, however the EPSS score of less than 1% suggests current exploitation risk is low. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the attack vector is likely via untrusted user input presented in the SmartShare interface—such as URL parameters or form fields—though the exact mechanics are not detailed. No official fix or workaround is documented in the provided references, meaning defenses must rely on patching when available or mitigating the attack surface.