Who is not affected by CVE-2026-123996?

Q: Who is not affected by CVE-2026-123996?

Not affected if: isolated-network, other-firmware.

MEDIUM4.8CVSS · disclosure@vulncheck.com

NO KNOWN
EXPLOIT

CVE-2026-123996 · Other

Hisense VIDAA smart TV: LAN attacker can change volume and reset settings

NO FIX YET

Hisense VIDAA smart TV firmware V0000.01.00a.P0220 exposes its UPnP/DLNA RenderingControl service on TCP port 38400 without per-command authentication after a one-time pairing. A device on the same local network can change volume and mute, and reset picture and audio calibration.

first public Nov 6, 2026 · 1 source

Check it with your coding agent

It checks your repository and tells you if you’re affected, with the fix.

01 · Who is affected

Owners of Hisense VIDAA smart TVs running firmware V0000.01.00a.P0220 are exposed when another device on their local network can reach TCP port 38400. The sources do not say whether other firmware versions or models are affected, and the sources do not describe a fix. Households and offices whose TVs sit on an isolated network are less exposed.

Not affected if isolated-network, other-firmware

Who cares dlna, hisense, smart-tv, upnp, vidaa

02 · How to check

Unknown from the sources.

03 · The fix

No fix yet, per the sources.

Exploited: No reports yet
Public exploit: None on GitHub
EPSS: Not scored
Last updated: Nov 6, 2026

How it unfolded

1 events · Nov 6, 2026 → Nov 6, 2026

Nov 6, 202619:43 UTCNVD CVE-2026-123996

What the sources say, verbatim

525 characters

Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains a missing authentication vulnerability in the UPnP/DLNA RenderingControl service on TCP port 38400 that allows a LAN-adjacent attacker to issue SetVolume, SetMute, and SelectPreset(FactoryDefaults) commands after a one-time DLNA pairing with no per-command authentication or session token. Attackers can send a continuous loop of unauthenticated commands to override the physical remote, change volume and mute, and reset all picture and audio calibration settings.

Sources and references

NVD: CVE-2026-123996Nov 6, 2026
Third-party advisory: www.vulncheck.comAdvisory · vulncheck.com

This page as .md · .json · CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.

Are you affected?

Tell InfraStack what you run. It checks this one, and every next one, against your stack.

Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.

InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.

In Slack

Run the check