Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-123995 Details

Description

Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an input validation vulnerability in the UPnP/DLNA AVTransport SOAP service that allows a LAN-adjacent attacker to inject arbitrary URIs via the CurrentURI field of SetAVTransportURI without validating the scheme, host, or media legitimacy. Attackers can supply schemes such as http://, file:///data/misc/wifi/, rtsp://, or smb:// to have the TV fetch and render attacker-controlled content after a one-time DLNA pairing, enabling phishing pages, fake firmware prompts, and fake emergency alerts to be displayed, with subsequent commands executing silently.

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: [email protected]CVSS-B:4.6 MEDIUMVector:CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/yehia-mamdouh/Hisense-Smart-TV-Security-Research	[email protected]
https://www.vulncheck.com/advisories/hisense-vidaa-smart-tv-ssrf-via-setavtransporturi-currenturi	[email protected]

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-306	Missing Authentication for Critical Function	[email protected]
CWE-451	User Interface (UI) Misrepresentation of Critical Information	[email protected]

Affected Products

No affected product data is available for this CVE.

Change History

1 change record found show changes