Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-123993 Details

Description

Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an unauthenticated access vulnerability where a QA build of the Google Cobalt browser engine exposes the WebDriver automation server on TCP port 4444 across all network interfaces without any authentication or pairing requirement. A LAN-adjacent attacker can connect to the exposed WebDriver service to execute arbitrary JavaScript, read and exfiltrate sensitive localStorage data including ACR telemetry, MAC addresses, ad-service credentials, and location data, inject persistent content onto the display, and access the window.hisense native bridge to perform filesystem read/write and system-state operations.

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: [email protected]CVSS-B:8.8 HIGHVector:CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/yehia-mamdouh/Hisense-Smart-TV-Security-Research	[email protected]
https://www.vulncheck.com/advisories/hisense-vidaa-smart-tv-unauthenticated-webdriver-remote-access	[email protected]

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-306	Missing Authentication for Critical Function	[email protected]
CWE-489	Active Debug Code	[email protected]

Affected Products

No affected product data is available for this CVE.

Change History

1 change record found show changes