---
id: "CVE-2026-123993"
page: "https://infrastack.ai/live/CVE-2026-123993"
kind: "vulnerability"
aliases: ["CVE-2026-123993"]
title: "Hisense VIDAA smart TV firmware exposes unauthenticated browser automation port"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "VIDAA smart TV firmware", "fixed": [], "affected": "<= V0000.01.00a.P0220", "ecosystem": "vendor"}]
ecosystems: []
tags: ["hisense", "iot", "lan-adjacent", "smart-tv", "vendor", "vidaa", "webdriver"]
not_affected_if: ["not-on-lan", "other-firmware-builds", "unknown"]
published_at: "2026-11-06T19:17:44+00:00"
first_seen_at: "2026-11-06T19:43:48+00:00"
updated_at: "2026-11-06T19:46:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123993", "first_seen_at": "2026-11-06T19:43:48+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-06T19:46:44+00:00"}]
exploit_sources: []
---

# Hisense VIDAA smart TV firmware exposes unauthenticated browser automation port

Link for people: https://infrastack.ai/live/CVE-2026-123993 (this .md is for agents)

A QA build of the Cobalt browser engine in Hisense VIDAA TV firmware V0000.01.00a.P0220 listens on TCP port 4444 on all interfaces with no authentication. A device on the same local network can run JavaScript in the TV, read stored data such as viewing telemetry, MAC addresses and credentials, and write to the display and filesystem.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:VIDAA smart TV firmware affected <= V0000.01.00a.P0220 fixed no fixed version listed

## How to check

- Check the TV's firmware version in system information settings; the advisory lists V0000.01.00a.P0220 and earlier as affected.
- From another device on the same network, test whether TCP port 4444 on the TV's IP accepts a connection (e.g. nc -vz <tv-ip> 4444). The advisory does not give a command; this is a generic port check. An open port suggests the WebDriver service is exposed.

## Timeline

- 2026-11-06T19:43:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123993
- 2026-11-06T19:46:44+00:00 analyst — Read VulnCheck advisory (third-party CNA, credit Yehia Elghaly); no Hisense advisory or fixed build found, so fix unknown and nothing verified. Affecting listed as VIDAA <= 0000.01.00a.P0220 (advisory text also writes V0000...). CVSS v4 8.7 per VulnCheck. No PoC or exploitation found.

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/hisense-vidaa-smart-tv-unauthenticated-webdriver-remote-access

## From the sources

Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an unauthenticated access vulnerability where a QA build of the Google Cobalt browser engine exposes the WebDriver automation server on TCP port 4444 across all network interfaces without any authentication or pairing requirement. A LAN-adjacent attacker can connect to the exposed WebDriver service to execute arbitrary JavaScript, read and exfiltrate sensitive localStorage data including ACR telemetry, MAC addresses, ad-service credentials, and location data, inject persistent content onto the display, and access the window.hisense native bridge to perform filesystem read/write and system-state operations.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_