Unauthenticated Access in Hisense VIDAA Smart TV Firmware
CVE-2026-123994

5.3MEDIUM

Key Information:

Vendor

Hisense

Status
Vidaa
Vendor
CVE Published:
6 November 2026

Badges

👾 Exploit Exists

What is CVE-2026-123994?

The Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 exhibits a critical unauthenticated access vulnerability within the DIAL (Discovery and Launch) service. This vulnerability allows any device on the same LAN to send control requests without authentication or user notification. Attackers can exploit this weakness to query the status of running applications, list installed applications via HTTP response codes, terminate active sessions with DELETE requests, and potentially disrupt device functionality. Moreover, they can manipulate YouTube's Origin check, accessing sensitive viewing activity and subscriptions, thereby jeopardizing user privacy.

Affected Version(s)

VIDAA 0000.01.00a.P0220

References

https://github.com/yehia-mamdouh/Hisense-Smart-TV-Securit...
technical-descriptionexploit
https://www.vulncheck.com/advisories/hisense-vidaa-smart-...
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yehia Elghaly (Mrvar0x)
.