CVE-2026-123994mediumCWE-306

CVE-2026-123994: fallo de gravedad media en Hisense VIDAA

Hisense VIDAA Smart TV DIAL Service Unauthenticated Access

Publicada el

Seguir esta CVE+ Monitorear VIDAA

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

30Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 5.3
Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an unauthenticated access vulnerability in the DIAL (Discovery and Launch) service on TCP port 56789, which accepts control requests from any LAN-adjacent device without authentication, pairing, or user notification. Attackers can query running application states, enumerate installed applications via HTTP response codes, terminate active sessions with a DELETE request, and launch applications or bypass YouTube's Origin check by spoofing the Origin header to disclose viewing activity and subscriptions or disrupt device functionality.
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Productos afectados
Hisense · VIDAA
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — Hisense VIDAA

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-123998HIGHHisense VIDAA Smart TV MQTT Broker Authentication BypassEPSS —CVE-2026-123997HIGHHisense VIDAA Smart TV Unauthenticated DoS via SetAVTransportURIEPSS —CVE-2026-123996MEDIUMHisense VIDAA Smart TV UPnP/DLNA Missing AuthenticationEPSS —CVE-2026-123995MEDIUMHisense VIDAA Smart TV SSRF via SetAVTransportURI CurrentURIEPSS —CVE-2026-123993HIGHHisense VIDAA Smart TV Unauthenticated WebDriver Remote AccessEPSS —