CVE-2026-123995: medium-severity vulnerability in Hisense VIDAA
Hisense VIDAA Smart TV SSRF via SetAVTransportURI CurrentURI
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
30Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 4.8
Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an input validation vulnerability in the UPnP/DLNA AVTransport SOAP service that allows a LAN-adjacent attacker to inject arbitrary URIs via the CurrentURI field of SetAVTransportURI without validating the scheme, host, or media legitimacy. Attackers can supply schemes such as http://, file:///data/misc/wifi/, rtsp://, or smb:// to have the TV fetch and render attacker-controlled content after a one-time DLNA pairing, enabling phishing pages, fake firmware prompts, and fake emergency alerts to be displayed, with subsequent commands executing silently.
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
Hisense · VIDAApublic PoCs found — 1
cve_referencegithub.com/yehia-mamdouh/Hisense-Smart-TV-Security-Researchunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Hisense VIDAA
In the same product, most dangerous first.
CVE-2026-123998HIGHHisense VIDAA Smart TV MQTT Broker Authentication BypassEPSS —CVE-2026-123997HIGHHisense VIDAA Smart TV Unauthenticated DoS via SetAVTransportURIEPSS —CVE-2026-123996MEDIUMHisense VIDAA Smart TV UPnP/DLNA Missing AuthenticationEPSS —CVE-2026-123994MEDIUMHisense VIDAA Smart TV DIAL Service Unauthenticated AccessEPSS —CVE-2026-123993HIGHHisense VIDAA Smart TV Unauthenticated WebDriver Remote AccessEPSS —