Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-123994— Hisense VIDAA Smart TV DIAL Service Unauthenticated Access

Quick assessment

Affected
Hisense VIDAA
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

海信 VIDAA 智能电视固件版本 V0000.01.00a.P0220 在 TCP 端口 56789 上运行的 DIAL（Discovery and Launch）服务中存在一个无需身份验证的访问漏洞。该服务会接受来自同一局域网内任意设备的控制请求，且无需进行身份验证、设备配对或向用户发出通知。攻击者可利用此漏洞查询正在运行的应用程序状态，通过 HTTP 响应代码枚举已安装的应用程序，发送 DELETE 请求终止当前活动会话，或启动应用程序。此外，攻击者还可通过伪造 Origin 请求头来绕过 YouTube 的

CVSS 6.3 · Medium

Affected Version Matrix 1

VendorProduct Version RangeStatus
Hisense VIDAA 0000.01.00a.P0220 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-123994

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Hisense VIDAA Smart TV DIAL Service Unauthenticated Access
Source: CVE Program / CVE List V5
Vulnerability Description
Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an unauthenticated access vulnerability in the DIAL (Discovery and Launch) service on TCP port 56789, which accepts control requests from any LAN-adjacent device without authentication, pairing, or user notification. Attackers can query running application states, enumerate installed applications via HTTP response codes, terminate active sessions with a DELETE request, and launch applications or bypass YouTube's Origin check by spoofing the Origin header to disclose viewing activity and subscriptions or disrupt device functionality.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Hisense VIDAA 0000.01.00a.P0220 -

II. Public POCs for CVE-2026-123994

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-123994

请登录查看更多情报信息。

Other References for CVE-2026-123994 (2)

Same Patch Batch · Hisense · 2026-11-06 · 6 CVEs total

CVE-2026-123993 8.8 HIGH Hisense VIDAA Smart TV Unauthenticated WebDriver Remote Access
CVE-2026-123998 8.3 HIGH Hisense VIDAA Smart TV MQTT Broker Authentication Bypass
CVE-2026-123997 6.5 MEDIUM Hisense VIDAA Smart TV Unauthenticated DoS via SetAVTransportURI
CVE-2026-123996 4.6 MEDIUM Hisense VIDAA Smart TV UPnP/DLNA Missing Authentication
CVE-2026-123995 4.6 MEDIUM Hisense VIDAA Smart TV SSRF via SetAVTransportURI CurrentURI

IV. Related Vulnerabilities

Same product: VIDAA
Same vendor: Hisense
Same weakness: CWE-306