Read the docs
TI-2026-86076 Aliases CVE-2026-123994GHSA-h68h-965v-xmp9

Hisense VIDAA Smart TV DIAL Service Unauthenticated Access

Priority LOW 23CWE-306Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · Low
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an unauthenticated access flaw in its DIAL (Discovery and Launch) service on TCP port 56789. The service accepts control requests from any LAN-adjacent device without authentication, pairing, or user notification (CWE-306). A nearby attacker on the local network can query application states, enumerate installed applications, terminate active sessions, and launch applications, including bypassing YouTube's Origin check, to disclose viewing activity and subscriptions or disrupt the device. A public exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an unauthenticated access vulnerability in the DIAL (Discovery and Launch) service on TCP port 56789, which accepts control requests from any LAN-adjacent device without authentication, pairing, or user notification. Attackers can query running application states, enumerate installed applications via HTTP response codes, terminate active sessions with a DELETE request, and launch applications or bypass YouTube's Origin check by spoofing the Origin header to disclose viewing activity and subscriptions or disrupt device functionality.

Why it matters now

EPSS 0.00196 9th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
HisenseVIDAA0000.01.00a.P0220—No fix listedCNA
  • VIDAA VendorHisense Affected 0000.01.00a.P0220 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Hisense VIDAA.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-123994
  2. 2026-11-06 Alias added: GHSA-h68h-965v-xmp9

References

Exploit 1

  • TI-2026-86075 Unauthenticated WebDriver access in Hisense VIDAA Smart TV CVSS 4.0HIGH 8.7
  • TI-2026-86080 Authentication bypass in Hisense VIDAA Smart TV MQTT broker CVSS 4.0HIGH 7.2
  • TI-2026-86079 Denial of service in Hisense VIDAA Smart TV via UPnP AVTransport CVSS 4.0HIGH 7.1
  • TI-2019-11476 The Hisense F17 Android device with a build fingerprint of… CVSS 3.1MEDIUM 5.5
  • TI-2019-11464 The Hisense U965 Android device with a build fingerprint of… CVSS 3.1MEDIUM 5.5
  • TI-2026-86078 Missing authentication in Hisense VIDAA Smart TV UPnP/DLNA service CVSS 4.0MEDIUM 4.8
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences