CVE-2026-123996 | BDVDB-2026-401322 Detail
HisenseVIDAA
Description#
Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains a missing authentication vulnerability in the UPnP/DLNA RenderingControl service on TCP port 38400 that allows a LAN-adjacent attacker to issue SetVolume, SetMute, and SelectPreset(FactoryDefaults) commands after a one-time DLNA pairing with no per-command authentication or session token. Attackers can send a continuous loop of unauthenticated commands to override the physical remote, change volume and mute, and reset all picture and audio calibration settings.
Impact#
Per CVSS v3.1: confidentiality impact none, integrity impact low, availability impact low. Attack vector: adjacent.
Weaknesses#
- CWE-306 Missing Authentication for Critical Function
References#
Exploit#
History#
- Version 1Record published in the CVE List.