---
id: "CVE-2026-123994"
page: "https://infrastack.ai/live/CVE-2026-123994"
kind: "vulnerability"
aliases: ["CVE-2026-123994"]
title: "Hisense VIDAA smart TV: unauthenticated DIAL service lets LAN devices control apps"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["hisense", "infrastructure", "iot", "lan", "smart-tv", "vidaa"]
not_affected_if: ["no-lan-access", "other-firmware"]
published_at: "2026-11-06T19:17:44+00:00"
first_seen_at: "2026-11-06T19:43:48+00:00"
updated_at: "2026-11-06T19:45:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123994", "first_seen_at": "2026-11-06T19:43:48+00:00"}]
exploit_sources: []
---

# Hisense VIDAA smart TV: unauthenticated DIAL service lets LAN devices control apps

Link for people: https://infrastack.ai/live/CVE-2026-123994 (this .md is for agents)

The DIAL service on TCP port 56789 of Hisense VIDAA smart TV firmware V0000.01.00a.P0220 accepts control requests from any device on the local network without authentication or pairing. An attacker on the same network can list and launch apps, end sessions, and read YouTube viewing activity and subscriptions by spoofing the Origin header.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the TV runs firmware `V0000.01.00a.P0220` in its system information settings
- From the same LAN, check whether TCP port `56789` answers on the TV's IP address

## Timeline

- 2026-11-06T19:43:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123994

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/hisense-vidaa-smart-tv-dial-service-unauthenticated-access

## From the sources

Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an unauthenticated access vulnerability in the DIAL (Discovery and Launch) service on TCP port 56789, which accepts control requests from any LAN-adjacent device without authentication, pairing, or user notification. Attackers can query running application states, enumerate installed applications via HTTP response codes, terminate active sessions with a DELETE request, and launch applications or bypass YouTube's Origin check by spoofing the Origin header to disclose viewing activity and subscriptions or disrupt device functionality.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_