{"id":"CVE-2026-123994","kind":"vulnerability","aliases":["CVE-2026-123994"],"related":[],"title":"Hisense VIDAA smart TV: unauthenticated DIAL service lets LAN devices control apps","description":"Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an unauthenticated access vulnerability in the DIAL (Discovery and Launch) service on TCP port 56789, which accepts control requests from any LAN-adjacent device without authentication, pairing, or user notification. Attackers can query running application states, enumerate installed applications via HTTP response codes, terminate active sessions with a DELETE request, and launch applications or bypass YouTube's Origin check by spoofing the Origin header to disclose viewing activity and subscriptions or disrupt device functionality.","summary":"The DIAL service on TCP port 56789 of Hisense VIDAA smart TV firmware V0000.01.00a.P0220 accepts control requests from any device on the local network without authentication or pairing. An attacker on the same network can list and launch apps, end sessions, and read YouTube viewing activity and subscriptions by spoofing the Origin header.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hisense","infrastructure","iot","lan","smart-tv","vidaa"],"not_affected_if":["no-lan-access","other-firmware"],"how_to_check":"- Check whether the TV runs firmware `V0000.01.00a.P0220` in its system information settings\n- From the same LAN, check whether TCP port `56789` answers on the TV's IP address","fix":null,"status":"open","published_at":"2026-11-06T19:17:44+00:00","first_seen_at":"2026-11-06T19:43:48+00:00","triaged_at":"2026-11-06T19:45:57+00:00","updated_at":"2026-11-06T19:45:57+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-06T19:45:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Hisense VIDAA smart TV: unauthenticated DIAL service lets LAN devices control apps","impact":"medium","summary":"The DIAL service on TCP port 56789 of Hisense VIDAA smart TV firmware V0000.01.00a.P0220 accepts control requests from any device on the local network without authentication or pairing. An attacker on the same network can list and launch apps, end sessions, and read YouTube viewing activity and subscriptions by spoofing the Origin header.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["hisense","vidaa","smart-tv","iot","lan"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Other LAN devices can end viewing sessions and read YouTube activity.","analyst_note":"Confirm the fixed firmware and whether DIAL on port 56789 can be disabled; check the vendor advisory and the VulnCheck advisory.","how_to_check":"- Check whether the TV runs firmware `V0000.01.00a.P0220` in its system information settings\n- From the same LAN, check whether TCP port `56789` answers on the TV's IP address\n- unknown whether the sources list a settings toggle that disables DIAL","plain_action":"Check your Hisense VIDAA TV's firmware version and install any update Hisense releases for it; the sources do not name a fixed version.","needs_analyst":true,"not_affected_if":["other-firmware","no-lan-access"],"who_is_affected":"Owners of Hisense VIDAA smart TVs running firmware V0000.01.00a.P0220 are exposed to any device on the same local network, such as a guest device on shared Wi-Fi. The sources do not say whether other firmware builds or the DIAL service setting change exposure. Teams with these TVs on office or guest networks should treat them as reachable by any LAN-adjacent device.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00079,"input_tokens":4359,"output_tokens":709,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123994':15A,18A '-2026':14A,17A '56789':33B,101C 'accept':41B,103C 'access':89C 'activ':72B,132C,155C 'adjac':110C 'app':12A,65B 'applic':122C,126C,140C 'attack':56B,118C 'authent':52B,113C 'bypass':142C 'check':146C 'code':130C 'contain':86C 'control':11A,42B,104C 'cve':13A,16A 'delet':136C 'devic':10A,46B,111C,160C 'dial':6A,28B,93C 'disclos':153C 'discoveri':94C 'disrupt':159C 'end':66B 'enumer':124C 'firmwar':39B,84C 'function':161C 'header':79B,151C 'hisens':1A,19B,35B,80C 'http':128C 'infrastructur':20B 'instal':125C 'iot':21B 'lan':9A,22B,109C 'lan-adjac':108C 'launch':64B,96C,139C 'let':8A 'list':62B 'local':49B 'network':50B,60B 'notif':117C 'origin':78B,145C,150C 'pair':54B,114C 'port':32B,100C 'queri':120C 'read':69B 'request':43B,105C,137C 'respons':129C 'run':121C 'servic':7A,29B,97C 'session':67B,133C 'smart':3A,24B,37B,82C 'smart-tv':23B 'spoof':76B,148C 'state':123C 'subscript':74B,157C 'tcp':31B,99C 'termin':131C 'tv':4A,25B,38B,83C 'unauthent':5A,88C 'user':116C 'v0000.01.00a.p0220':40B,85C 'via':127C 'vidaa':2A,26B,36B,81C 'view':71B,154C 'vulner':90C 'without':51B,112C 'youtub':70B,143C","nicknames":[],"mitigations":[],"who_affected":"Owners of Hisense VIDAA smart TVs running firmware V0000.01.00a.P0220 are exposed to any device on the same local network, such as a guest device on shared Wi-Fi. The sources do not say whether other firmware builds or the DIAL service setting change exposure. Teams with these TVs on office or guest networks should treat them as reachable by any LAN-adjacent device.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"Check your Hisense VIDAA TV's firmware version and install any update Hisense releases for it; the sources do not name a fixed version.","pkeys":[],"ptokens":[],"labels":["hisense","infrastructure","iot","lan","medium","smarttv","vidaa"],"campaign_type":null,"search_a":"'-123994':15A,18A '-2026':14A,17A 'app':12A 'control':11A 'cve':13A,16A 'devic':10A 'dial':6A 'hisens':1A 'lan':9A 'let':8A 'servic':7A 'smart':3A 'tv':4A 'unauthent':5A 'vidaa':2A","search_b":"'56789':33B 'accept':41B 'activ':72B 'app':65B 'attack':56B 'authent':52B 'control':42B 'devic':46B 'dial':28B 'end':66B 'firmwar':39B 'header':79B 'hisens':19B,35B 'infrastructur':20B 'iot':21B 'lan':22B 'launch':64B 'list':62B 'local':49B 'network':50B,60B 'origin':78B 'pair':54B 'port':32B 'read':69B 'request':43B 'servic':29B 'session':67B 'smart':24B,37B 'smart-tv':23B 'spoof':76B 'subscript':74B 'tcp':31B 'tv':25B,38B 'v0000.01.00a.p0220':40B 'vidaa':26B,36B 'view':71B 'without':51B 'youtub':70B","search_c":"'56789':101C 'accept':103C 'access':89C 'activ':132C,155C 'adjac':110C 'applic':122C,126C,140C 'attack':118C 'authent':113C 'bypass':142C 'check':146C 'code':130C 'contain':86C 'control':104C 'delet':136C 'devic':111C,160C 'dial':93C 'disclos':153C 'discoveri':94C 'disrupt':159C 'enumer':124C 'firmwar':84C 'function':161C 'header':151C 'hisens':80C 'http':128C 'instal':125C 'lan':109C 'lan-adjac':108C 'launch':96C,139C 'notif':117C 'origin':145C,150C 'pair':114C 'port':100C 'queri':120C 'request':105C,137C 'respons':129C 'run':121C 'servic':97C 'session':133C 'smart':82C 'spoof':148C 'state':123C 'subscript':157C 'tcp':99C 'termin':131C 'tv':83C 'unauthent':88C 'user':116C 'v0000.01.00a.p0220':85C 'via':127C 'vidaa':81C 'view':154C 'vulner':90C 'without':112C 'youtub':143C","first_public_at":"2026-11-06T19:17:44+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123994","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123994","severity":null,"published_at":"2026-11-06T19:17:44+00:00","modified_at":"2026-11-06T19:17:44+00:00","first_seen_at":"2026-11-06T19:43:48+00:00","fetched_at":"2026-11-06T19:43:48+00:00","note":null}],"documents":[{"id":89347,"url":"https://www.vulncheck.com/advisories/hisense-vidaa-smart-tv-dial-service-unauthenticated-access","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}