{"id":"CVE-2026-123993","kind":"vulnerability","aliases":["CVE-2026-123993"],"related":[],"title":"Hisense VIDAA smart TV firmware exposes unauthenticated browser automation port","description":"Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an unauthenticated access vulnerability where a QA build of the Google Cobalt browser engine exposes the WebDriver automation server on TCP port 4444 across all network interfaces without any authentication or pairing requirement. A LAN-adjacent attacker can connect to the exposed WebDriver service to execute arbitrary JavaScript, read and exfiltrate sensitive localStorage data including ACR telemetry, MAC addresses, ad-service credentials, and location data, inject persistent content onto the display, and access the window.hisense native bridge to perform filesystem read/write and system-state operations.","summary":"A QA build of the Cobalt browser engine in Hisense VIDAA TV firmware V0000.01.00a.P0220 listens on TCP port 4444 on all interfaces with no authentication. A device on the same local network can run JavaScript in the TV, read stored data such as viewing telemetry, MAC addresses and credentials, and write to the display and filesystem.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"VIDAA smart TV firmware","fixed":[],"affected":"<= V0000.01.00a.P0220","ecosystem":"vendor"}],"ecosystems":[],"tags":["hisense","iot","lan-adjacent","smart-tv","vendor","vidaa","webdriver"],"not_affected_if":["not-on-lan","other-firmware-builds","unknown"],"how_to_check":"- Check the TV's firmware version in system information settings; the advisory lists V0000.01.00a.P0220 and earlier as affected.\n- From another device on the same network, test whether TCP port 4444 on the TV's IP accepts a connection (e.g. nc -vz <tv-ip> 4444). The advisory does not give a command; this is a generic port check. An open port suggests the WebDriver service is exposed.","fix":null,"status":"open","published_at":"2026-11-06T19:17:44+00:00","first_seen_at":"2026-11-06T19:43:48+00:00","triaged_at":"2026-11-06T19:45:48+00:00","updated_at":"2026-11-06T19:46:44+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-06T19:45:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Hisense VIDAA smart TV firmware exposes unauthenticated browser automation port","impact":"high","summary":"A QA build of the Cobalt browser engine in Hisense VIDAA TV firmware V0000.01.00a.P0220 listens on TCP port 4444 on all interfaces with no authentication. A device on the same local network can run JavaScript in the TV, read stored data such as viewing telemetry, MAC addresses and credentials, and write to the display and filesystem.","audience":"everyone","category":"vendor","nicknames":[],"who_cares":["hisense","vidaa","smart-tv","iot"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"LAN attacker runs code on TV and reads stored credentials","analyst_note":"Confirm affected firmware range, whether a fixed build exists, and the vendor's own advisory; the only extra source is a VulnCheck advisory link.","how_to_check":"- Check whether the TV runs firmware `V0000.01.00a.P0220` in its system information settings\n- From the local network, check whether TCP port `4444` on the TV's address accepts connections (unknown whether the sources give a specific command)","plain_action":"Check your Hisense VIDAA TV's firmware version and install any update from Hisense; the sources do not name a fixed version.","needs_analyst":true,"not_affected_if":["other-firmware-builds","not-on-lan","unknown"],"who_is_affected":"Owners of Hisense smart TVs running the VIDAA firmware build named in the advisory are exposed, and any device on the same local network can reach the open port. The sources do not say whether other firmware builds or models are affected, nor whether a fix has shipped.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.00076,"input_tokens":4388,"output_tokens":643,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected firmware range, whether a fixed build exists, and the vendor's own advisory; the only extra source is a VulnCheck advisory link.","search":"'-123993':13A,16A '-2026':12A,15A '4444':50B,117C 'access':97C,169C 'acr':151C 'across':118C 'ad':156C 'ad-servic':155C 'address':78B,154C 'adjac':25B,131C 'arbitrari':142C 'attack':132C 'authent':56B,124C 'autom':9A,112C 'bridg':173C 'browser':8A,38B,107C 'build':34B,102C 'cobalt':37B,106C 'connect':134C 'contain':94C 'content':164C 'credenti':80B,158C 'cve':11A,14A 'data':72B,149C,161C 'devic':58B 'display':85B,167C 'engin':39B,108C 'execut':141C 'exfiltr':146C 'expos':6A,109C,137C 'filesystem':87B,176C 'firmwar':5A,44B,92C 'firmware':20A 'googl':105C 'hisens':1A,21B,41B,88C 'includ':150C 'inject':162C 'interfac':53B,121C 'iot':22B 'javascript':66B,143C 'lan':24B,130C 'lan-adjac':23B,129C 'listen':46B 'local':62B 'localstorag':148C 'locat':160C 'mac':77B,153C 'nativ':172C 'network':63B,120C 'onto':165C 'oper':182C 'pair':126C 'perform':175C 'persist':163C 'port':10A,49B,116C 'qa':33B,101C 'read':70B,144C 'read/write':177C 'requir':127C 'run':65B 'sensit':147C 'server':113C 'servic':139C,157C 'smart':3A,18A,27B,90C 'smart-tv':26B 'state':181C 'store':71B 'system':180C 'system-st':179C 'tcp':48B,115C 'telemetri':76B,152C 'tv':4A,19A,28B,43B,69B,91C 'unauthent':7A,96C 'v0000.01.00a.p0220':45B,93C 'vendor':29B 'vidaa':2A,17A,30B,42B,89C 'view':75B 'vulner':98C 'webdriv':31B,111C,138C 'window.hisense':171C 'without':122C 'write':82B","nicknames":[],"mitigations":[],"who_affected":"Owners of Hisense smart TVs running the VIDAA firmware build named in the advisory are exposed, and any device on the same local network can reach the open port. The sources do not say whether other firmware builds or models are affected, nor whether a fix has shipped.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"everyone","plain_action":"Check your Hisense VIDAA TV's firmware version and install any update from Hisense; the sources do not name a fixed version.","pkeys":["smarttvfirmware","vidaasmarttvfirmware"],"ptokens":["firmware","smart","tv","vidaa"],"labels":["high","hisense","iot","lanadjacent","smarttv","vendor","vidaa","webdriver"],"campaign_type":null,"search_a":"'-123993':13A,16A '-2026':12A,15A 'autom':9A 'browser':8A 'cve':11A,14A 'expos':6A 'firmwar':5A 'firmware':20A 'hisens':1A 'port':10A 'smart':3A,18A 'tv':4A,19A 'unauthent':7A 'vidaa':2A,17A","search_b":"'4444':50B 'address':78B 'adjac':25B 'authent':56B 'browser':38B 'build':34B 'cobalt':37B 'credenti':80B 'data':72B 'devic':58B 'display':85B 'engin':39B 'filesystem':87B 'firmwar':44B 'hisens':21B,41B 'interfac':53B 'iot':22B 'javascript':66B 'lan':24B 'lan-adjac':23B 'listen':46B 'local':62B 'mac':77B 'network':63B 'port':49B 'qa':33B 'read':70B 'run':65B 'smart':27B 'smart-tv':26B 'store':71B 'tcp':48B 'telemetri':76B 'tv':28B,43B,69B 'v0000.01.00a.p0220':45B 'vendor':29B 'vidaa':30B,42B 'view':75B 'webdriv':31B 'write':82B","search_c":"'4444':117C 'access':97C,169C 'acr':151C 'across':118C 'ad':156C 'ad-servic':155C 'address':154C 'adjac':131C 'arbitrari':142C 'attack':132C 'authent':124C 'autom':112C 'bridg':173C 'browser':107C 'build':102C 'cobalt':106C 'connect':134C 'contain':94C 'content':164C 'credenti':158C 'data':149C,161C 'display':167C 'engin':108C 'execut':141C 'exfiltr':146C 'expos':109C,137C 'filesystem':176C 'firmwar':92C 'googl':105C 'hisens':88C 'includ':150C 'inject':162C 'interfac':121C 'javascript':143C 'lan':130C 'lan-adjac':129C 'localstorag':148C 'locat':160C 'mac':153C 'nativ':172C 'network':120C 'onto':165C 'oper':182C 'pair':126C 'perform':175C 'persist':163C 'port':116C 'qa':101C 'read':144C 'read/write':177C 'requir':127C 'sensit':147C 'server':113C 'servic':139C,157C 'smart':90C 'state':181C 'system':180C 'system-st':179C 'tcp':115C 'telemetri':152C 'tv':91C 'unauthent':96C 'v0000.01.00a.p0220':93C 'vidaa':89C 'vulner':98C 'webdriv':111C,138C 'window.hisense':171C 'without':122C","first_public_at":"2026-11-06T19:17:44+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123993","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123993","severity":null,"published_at":"2026-11-06T19:17:44+00:00","modified_at":"2026-11-06T19:17:44+00:00","first_seen_at":"2026-11-06T19:43:48+00:00","fetched_at":"2026-11-06T19:43:48+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-123993:1925","url":null,"severity":null,"published_at":"2026-11-06T19:46:44+00:00","modified_at":"2026-11-06T19:46:44+00:00","first_seen_at":"2026-11-06T19:46:44+00:00","fetched_at":"2026-11-06T19:46:44+00:00","note":"Read VulnCheck advisory (third-party CNA, credit Yehia Elghaly); no Hisense advisory or fixed build found, so fix unknown and nothing verified. Affecting listed as VIDAA <= 0000.01.00a.P0220 (advisory text also writes V0000...). CVSS v4 8.7 per VulnCheck. No PoC or exploitation found."}],"documents":[{"id":89346,"url":"https://www.vulncheck.com/advisories/hisense-vidaa-smart-tv-unauthenticated-webdriver-remote-access","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}