Unauthenticated Access Vulnerability in Hisense VIDAA Smart TV Firmware
CVE-2026-123993

8.7HIGH

Key Information:

Vendor

Hisense

Status
Vidaa
Vendor
CVE Published:
6 November 2026

Badges

👾 Exploit Exists

What is CVE-2026-123993?

The Hisense VIDAA Smart TV firmware version V0000.01.00a.P0220 contains a serious vulnerability that exposes the WebDriver automation server on TCP port 4444 across all network interfaces without any form of authentication or requirement for pairing. This flaw allows attackers on the same local area network to connect to the exposed WebDriver service. Consequently, they can execute arbitrary JavaScript, which facilitates the reading and exfiltration of sensitive local storage data. Such data may include ACR telemetry information, MAC addresses, ad-service credentials, and location details. The vulnerability also enables the injection of persistent content onto the TV display and grants access to the window.hisense native bridge, allowing attackers to perform file system read/write operations and gain insights into the system's state.

Affected Version(s)

VIDAA 0000.01.00a.P0220

References

https://github.com/yehia-mamdouh/Hisense-Smart-TV-Securit...
technical-descriptionexploit
https://www.vulncheck.com/advisories/hisense-vidaa-smart-...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yehia Elghaly (Mrvar0x)
.