Unauthenticated Denial-of-Service in Hisense VIDAA Smart TV Firmware
CVE-2026-123997

7.1HIGH

Key Information:

Vendor

Hisense

Status
Vidaa
Vendor
CVE Published:
6 November 2026

Badges

👾 Exploit Exists

What is CVE-2026-123997?

The Hisense VIDAA Smart TV firmware version V0000.01.00a.P0220 is vulnerable to a denial-of-service attack due to an issue in the UPnP/DLNA AVTransport SOAP service. This vulnerability allows attackers on the local area network to send specially crafted SetAVTransportURI requests to TCP port 38400, causing the television to freeze completely. With this flaw, no credentials are needed, leading to a complete loss of control over the device, which can only be remedied by physically power cycling the TV.

Affected Version(s)

VIDAA 0000.01.00a.P0220

References

https://github.com/yehia-mamdouh/Hisense-Smart-TV-Securit...
technical-descriptionexploit
https://www.vulncheck.com/advisories/hisense-vidaa-smart-...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yehia Elghaly (Mrvar0x)
.