Missing Authentication in Hisense VIDAA Smart TV Firmware
CVE-2026-123996

4.8MEDIUM

Key Information:

Vendor

Hisense

Status
Vidaa
Vendor
CVE Published:
6 November 2026

Badges

👾 Exploit Exists

What is CVE-2026-123996?

The Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 suffers from a missing authentication vulnerability within the UPnP/DLNA RenderingControl service. This flaw enables LAN-adjacent attackers to issue commands such as SetVolume, SetMute, and SelectPreset(FactoryDefaults) after establishing a one-time DLNA pairing, without requiring any per-command authentication or session token. Consequently, attackers can send a continuous stream of unauthenticated commands, overriding physical remote controls, adjusting volume, muting settings, and resetting image and audio calibration parameters.

Affected Version(s)

VIDAA 0000.01.00a.P0220

References

https://github.com/yehia-mamdouh/Hisense-Smart-TV-Securit...
technical-descriptionexploit
https://www.vulncheck.com/advisories/hisense-vidaa-smart-...
third-party-advisory

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yehia Elghaly (Mrvar0x)
.