CVE-2026-123994 · Infrastructure
NO FIX YET
The DIAL service on TCP port 56789 of Hisense VIDAA smart TV firmware V0000.01.00a.P0220 accepts control requests from any device on the local network without authentication or pairing. An attacker on the same network can list and launch apps, end sessions, and read YouTube viewing activity and subscriptions by spoofing the Origin header.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Owners of Hisense VIDAA smart TVs running firmware V0000.01.00a.P0220 are exposed to any device on the same local network, such as a guest device on shared Wi-Fi. The sources do not say whether other firmware builds or the DIAL service setting change exposure. Teams with these TVs on office or guest networks should treat them as reachable by any LAN-adjacent device.
Not affected if no-lan-access, other-firmware
Who cares hisense, iot, lan, smart-tv, vidaa
V0000.01.00a.P0220 in its system information settings56789 answers on the TV's IP addressNo fix yet, per the sources.
Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an unauthenticated access vulnerability in the DIAL (Discovery and Launch) service on TCP port 56789, which accepts control requests from any LAN-adjacent device without authentication, pairing, or user notification. Attackers can query running application states, enumerate installed applications via HTTP response codes, terminate active sessions with a DELETE request, and launch applications or bypass YouTube's Origin check by spoofing the Origin header to disclose viewing activity and subscriptions or disrupt device functionality.
This page as .md · .json · CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.