CVE-2026-123995

MEDIUM 4.6

Hisense VIDAA Smart TV SSRF via SetAVTransportURI CurrentURI

CVSS Score

4.6

EPSS Score

0.0%

EPSS Percentile

0th

Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an input validation vulnerability in the UPnP/DLNA AVTransport SOAP service that allows a LAN-adjacent attacker to inject arbitrary URIs via the CurrentURI field of SetAVTransportURI without validating the scheme, host, or media legitimacy. Attackers can supply schemes such as http://, file:///data/misc/wifi/, rtsp://, or smb:// to have the TV fetch and render attacker-controlled content after a one-time DLNA pairing, enabling phishing pages, fake firmware prompts, and fake emergency alerts to be displayed, with subsequent commands executing silently.

CWE	CWE-451 CWE-306
Vendor	hisense
Product	vidaa
Published	Nov 6, 2026

Stay Ahead of the Next One

Get instant alerts for hisense vidaa

Be the first to know when new medium vulnerabilities affecting hisense vidaa are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

Hisense / VIDAA

0000.01.00a.P0220

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/yehia-mamdouh/Hisense-Smart-TV-Security-Research vulncheck.com: https://www.vulncheck.com/advisories/hisense-vidaa-smart-tv-ssrf-via-setavtransporturi-currenturi

Credits

Yehia Elghaly (Mrvar0x)