{"id":"CVE-2026-123995","kind":"vulnerability","aliases":["CVE-2026-123995"],"related":[],"title":"Hisense VIDAA TV: UPnP URI injection lets attackers display fake content","description":"Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an input validation vulnerability in the UPnP/DLNA AVTransport SOAP service that allows a LAN-adjacent attacker to inject arbitrary URIs via the CurrentURI field of SetAVTransportURI without validating the scheme, host, or media legitimacy. Attackers can supply schemes such as http://, file:///data/misc/wifi/, rtsp://, or smb:// to have the TV fetch and render attacker-controlled content after a one-time DLNA pairing, enabling phishing pages, fake firmware prompts, and fake emergency alerts to be displayed, with subsequent commands executing silently.","summary":"Hisense VIDAA smart TV firmware V0000.01.00a.P0220 does not validate media URIs sent to its UPnP/DLNA AVTransport service. A device on the same local network can make the TV fetch and display attacker-chosen content, such as phishing pages or fake alerts.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dlna","hisense","smart-tv","upnp","vendor","vidaa"],"not_affected_if":["isolated-network","no-dlna-pairing","other-firmware"],"how_to_check":"- Check the TV's firmware version in its settings menu against `V0000.01.00a.P0220`","fix":null,"status":"open","published_at":"2026-11-06T19:17:44+00:00","first_seen_at":"2026-11-06T19:43:48+00:00","triaged_at":"2026-11-06T19:46:00+00:00","updated_at":"2026-11-06T19:46:00+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-06T19:46:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Hisense VIDAA TV: UPnP URI injection lets attackers display fake content","impact":"medium","summary":"Hisense VIDAA smart TV firmware V0000.01.00a.P0220 does not validate media URIs sent to its UPnP/DLNA AVTransport service. A device on the same local network can make the TV fetch and display attacker-chosen content, such as phishing pages or fake alerts.","audience":"everyone","category":"vendor","nicknames":[],"who_cares":["hisense","vidaa","smart-tv","dlna","upnp"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker displays phishing pages and fake alerts on the TV screen","analyst_note":"Confirm the fixed firmware version and whether Hisense has issued a patch, via the vulncheck advisory and Hisense's support pages.","how_to_check":"- Check the TV's firmware version in its settings menu against `V0000.01.00a.P0220`\n- unknown","plain_action":"Check your Hisense VIDAA TV's firmware version and install any update Hisense has released for it.","needs_analyst":true,"not_affected_if":["other-firmware","no-dlna-pairing","isolated-network"],"who_is_affected":"Owners of Hisense VIDAA smart TVs on firmware V0000.01.00a.P0220 are exposed when a LAN-adjacent attacker has completed a one-time DLNA pairing with the set. Systems on the network that do not run this TV firmware are not affected by this flaw.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000737,"input_tokens":4402,"output_tokens":594,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123995':14A,17A '-2026':13A,16A '/data/misc/wifi':116C 'adjac':90C 'alert':67B,145C 'allow':86C 'arbitrari':94C 'attack':8A,58B,91C,110C,126C 'attacker-chosen':57B 'attacker-control':125C 'avtransport':41B,82C 'chosen':59B 'command':151C 'contain':74C 'content':11A,60B,128C 'control':127C 'currenturi':98C 'cve':12A,15A 'devic':44B 'display':9A,56B,148C 'dlna':18B,134C 'emerg':144C 'enabl':136C 'execut':152C 'fake':10A,66B,139C,143C 'fetch':54B,122C 'field':99C 'firmwar':30B,72C,140C 'hisens':1A,19B,26B,68C 'host':106C 'inject':6A,93C 'input':76C 'lan':89C 'lan-adjac':88C 'legitimaci':109C 'let':7A 'local':48B 'make':51B 'media':35B,108C 'network':49B 'one':132C 'one-tim':131C 'page':64B,138C 'pair':135C 'phish':63B,137C 'prompt':141C 'render':124C 'scheme':105C,113C 'sent':37B 'servic':42B,84C 'setavtransporturi':101C 'silent':153C 'smart':21B,28B,70C 'smart-tv':20B 'soap':83C 'subsequ':150C 'suppli':112C 'time':133C 'tv':3A,22B,29B,53B,71C,121C 'upnp':4A,23B 'upnp/dlna':40B,81C 'uri':5A,36B,95C 'v0000.01.00a.p0220':31B,73C 'valid':34B,77C,103C 'vendor':24B 'via':96C 'vidaa':2A,25B,27B,69C 'vulner':78C 'without':102C","nicknames":[],"mitigations":[],"who_affected":"Owners of Hisense VIDAA smart TVs on firmware V0000.01.00a.P0220 are exposed when a LAN-adjacent attacker has completed a one-time DLNA pairing with the set. Systems on the network that do not run this TV firmware are not affected by this flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"Check your Hisense VIDAA TV's firmware version and install any update Hisense has released for it.","pkeys":[],"ptokens":[],"labels":["dlna","hisense","medium","smarttv","upnp","vendor","vidaa"],"campaign_type":null,"search_a":"'-123995':14A,17A '-2026':13A,16A 'attack':8A 'content':11A 'cve':12A,15A 'display':9A 'fake':10A 'hisens':1A 'inject':6A 'let':7A 'tv':3A 'upnp':4A 'uri':5A 'vidaa':2A","search_b":"'alert':67B 'attack':58B 'attacker-chosen':57B 'avtransport':41B 'chosen':59B 'content':60B 'devic':44B 'display':56B 'dlna':18B 'fake':66B 'fetch':54B 'firmwar':30B 'hisens':19B,26B 'local':48B 'make':51B 'media':35B 'network':49B 'page':64B 'phish':63B 'sent':37B 'servic':42B 'smart':21B,28B 'smart-tv':20B 'tv':22B,29B,53B 'upnp':23B 'upnp/dlna':40B 'uri':36B 'v0000.01.00a.p0220':31B 'valid':34B 'vendor':24B 'vidaa':25B,27B","search_c":"'/data/misc/wifi':116C 'adjac':90C 'alert':145C 'allow':86C 'arbitrari':94C 'attack':91C,110C,126C 'attacker-control':125C 'avtransport':82C 'command':151C 'contain':74C 'content':128C 'control':127C 'currenturi':98C 'display':148C 'dlna':134C 'emerg':144C 'enabl':136C 'execut':152C 'fake':139C,143C 'fetch':122C 'field':99C 'firmwar':72C,140C 'hisens':68C 'host':106C 'inject':93C 'input':76C 'lan':89C 'lan-adjac':88C 'legitimaci':109C 'media':108C 'one':132C 'one-tim':131C 'page':138C 'pair':135C 'phish':137C 'prompt':141C 'render':124C 'scheme':105C,113C 'servic':84C 'setavtransporturi':101C 'silent':153C 'smart':70C 'soap':83C 'subsequ':150C 'suppli':112C 'time':133C 'tv':71C,121C 'upnp/dlna':81C 'uri':95C 'v0000.01.00a.p0220':73C 'valid':77C,103C 'via':96C 'vidaa':69C 'vulner':78C 'without':102C","first_public_at":"2026-11-06T19:17:44+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123995","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123995","severity":null,"published_at":"2026-11-06T19:17:44+00:00","modified_at":"2026-11-06T19:17:44+00:00","first_seen_at":"2026-11-06T19:43:48+00:00","fetched_at":"2026-11-06T19:43:48+00:00","note":null}],"documents":[{"id":89348,"url":"https://www.vulncheck.com/advisories/hisense-vidaa-smart-tv-ssrf-via-setavtransporturi-currenturi","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}