Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-123995— Hisense VIDAA Smart TV SSRF via SetAVTransportURI CurrentURI

Quick assessment

Affected

Hisense VIDAA

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

海信 VIDAA 智能电视固件版本 V0000.01.00a.P0220 在 UPnP/DLNA 的 AVTransport SOAP 服务中存在输入验证漏洞。该漏洞允许处于同一局域网（LAN）内的攻击者，通过 SetAVTransportURI 操作的 CurrentURI 字段注入任意 URI，且系统未对 URI 的协议类型、主机地址或媒体合法性进行验证。攻击者可指定如 http://、file:///data/misc/wifi/、rtsp:// 或 smb:// 等协议方案，在设备完成一次 DLNA 配对后

CVSS 4.6 · Medium Updated Nov 07, 2026

Possible ATT&CK Techniques 3 AI

T1059.007 · JavaScript T1566.001 · Spearphishing Attachment T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
Hisense	VIDAA	`0000.01.00a.P0220`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Hisense VIDAA Smart TV SSRF via SetAVTransportURI CurrentURI

Source: CVE Program / CVE List V5

Vulnerability Description

Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an input validation vulnerability in the UPnP/DLNA AVTransport SOAP service that allows a LAN-adjacent attacker to inject arbitrary URIs via the CurrentURI field of SetAVTransportURI without validating the scheme, host, or media legitimacy. Attackers can supply schemes such as http://, file:///data/misc/wifi/, rtsp://, or smb:// to have the TV fetch and render attacker-controlled content after a one-time DLNA pairing, enabling phishing pages, fake firmware prompts, and fake emergency alerts to be displayed, with subsequent commands executing silently.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

关键信息的UI错误表达

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Hisense	VIDAA	0000.01.00a.P0220	-

II. Public POCs for CVE-2026-123995

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-123995

请登录查看更多情报信息。

Other References for CVE-2026-123995 (2)

https://github.com/yehia-mamdouh/Hisense-Smart-TV-Security-Research technical-description exploit
https://www.vulncheck.com/advisories/hisense-vidaa-smart-tv-ssrf-via-setavtransporturi-currenturi third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-123995

Same Patch Batch · Hisense · 2026-11-06 · 6 CVEs total

CVE-2026-123993	8.8 HIGH	Hisense VIDAA Smart TV Unauthenticated WebDriver Remote Access
CVE-2026-123998	8.3 HIGH	Hisense VIDAA Smart TV MQTT Broker Authentication Bypass
CVE-2026-123997	6.5 MEDIUM	Hisense VIDAA Smart TV Unauthenticated DoS via SetAVTransportURI
CVE-2026-123994	6.3 MEDIUM	Hisense VIDAA Smart TV DIAL Service Unauthenticated Access
CVE-2026-123996	4.6 MEDIUM	Hisense VIDAA Smart TV UPnP/DLNA Missing Authentication

IV. Related Vulnerabilities

Same product: VIDAA

Same vendor: Hisense

Same weakness: CWE-451