Who is not affected by CVE-2026-123995?

Q: Who is not affected by CVE-2026-123995?

Not affected if: isolated-network, no-dlna-pairing, other-firmware.

MEDIUM4.8CVSS · disclosure@vulncheck.com

NO KNOWN
EXPLOIT

CVE-2026-123995 · Vendor

Hisense VIDAA TV: UPnP URI injection lets attackers display fake content

NO FIX YET

Hisense VIDAA smart TV firmware V0000.01.00a.P0220 does not validate media URIs sent to its UPnP/DLNA AVTransport service. A device on the same local network can make the TV fetch and display attacker-chosen content, such as phishing pages or fake alerts.

first public Nov 6, 2026 · 1 source

Check it with your coding agent

It checks your repository and tells you if you’re affected, with the fix.

01 · Who is affected

Owners of Hisense VIDAA smart TVs on firmware V0000.01.00a.P0220 are exposed when a LAN-adjacent attacker has completed a one-time DLNA pairing with the set. Systems on the network that do not run this TV firmware are not affected by this flaw.

Not affected if isolated-network, no-dlna-pairing, other-firmware

Who cares dlna, hisense, smart-tv, upnp, vidaa

02 · How to check

Check the TV's firmware version in its settings menu against V0000.01.00a.P0220

03 · The fix

No fix yet, per the sources.

Exploited: No reports yet
Public exploit: None on GitHub
EPSS: Not scored
Last updated: Nov 6, 2026

How it unfolded

1 events · Nov 6, 2026 → Nov 6, 2026

Nov 6, 202619:43 UTCNVD CVE-2026-123995

What the sources say, verbatim

617 characters

Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an input validation vulnerability in the UPnP/DLNA AVTransport SOAP service that allows a LAN-adjacent attacker to inject arbitrary URIs via the CurrentURI field of SetAVTransportURI without validating the scheme, host, or media legitimacy. Attackers can supply schemes such as http://, file:///data/misc/wifi/, rtsp://, or smb:// to have the TV fetch and render attacker-controlled content after a one-time DLNA pairing, enabling phishing pages, fake firmware prompts, and fake emergency alerts to be displayed, with subsequent commands executing silently.

Sources and references

NVD: CVE-2026-123995Nov 6, 2026
Third-party advisory: www.vulncheck.comAdvisory · vulncheck.com

This page as .md · .json · CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.

Are you affected?

Tell InfraStack what you run. It checks this one, and every next one, against your stack.

Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.

InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.

In Slack

Run the check