{"id":"CVE-2026-123996","kind":"vulnerability","aliases":["CVE-2026-123996"],"related":[],"title":"Hisense VIDAA smart TV: LAN attacker can change volume and reset settings","description":"Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains a missing authentication vulnerability in the UPnP/DLNA RenderingControl service on TCP port 38400 that allows a LAN-adjacent attacker to issue SetVolume, SetMute, and SelectPreset(FactoryDefaults) commands after a one-time DLNA pairing with no per-command authentication or session token. Attackers can send a continuous loop of unauthenticated commands to override the physical remote, change volume and mute, and reset all picture and audio calibration settings.","summary":"Hisense VIDAA smart TV firmware V0000.01.00a.P0220 exposes its UPnP/DLNA RenderingControl service on TCP port 38400 without per-command authentication after a one-time pairing. A device on the same local network can change volume and mute, and reset picture and audio calibration.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dlna","hisense","other","smart-tv","upnp","vidaa"],"not_affected_if":["isolated-network","other-firmware"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-06T19:17:45+00:00","first_seen_at":"2026-11-06T19:43:48+00:00","triaged_at":"2026-11-06T19:45:59+00:00","updated_at":"2026-11-06T19:45:59+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-06T19:45:59Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Hisense VIDAA smart TV: LAN attacker can change volume and reset settings","impact":"low","summary":"Hisense VIDAA smart TV firmware V0000.01.00a.P0220 exposes its UPnP/DLNA RenderingControl service on TCP port 38400 without per-command authentication after a one-time pairing. A device on the same local network can change volume and mute, and reset picture and audio calibration.","audience":"everyone","category":"other","nicknames":[],"who_cares":["hisense","vidaa","smart-tv","dlna","upnp"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"LAN attacker changes TV volume and resets calibration settings","analyst_note":"Check the VulnCheck advisory (www.vulncheck.com, linked above) for the affected firmware range, model list, and whether Hisense has released a fixed firmware.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["other-firmware","isolated-network"],"who_is_affected":"Owners of Hisense VIDAA smart TVs running firmware V0000.01.00a.P0220 are exposed when another device on their local network can reach TCP port 38400. The sources do not say whether other firmware versions or models are affected, and the sources do not describe a fix. Households and offices whose TVs sit on an isolated network are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000707,"input_tokens":4357,"output_tokens":542,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123996':15A,18A '-2026':14A,17A '38400':41B,90C 'adjac':96C 'allow':92C 'attack':6A,97C,122C 'audio':69B,145C 'authent':46B,80C,118C 'calibr':70B,146C 'chang':8A,61B,136C 'command':45B,105C,117C,130C 'contain':77C 'continu':126C 'cve':13A,16A 'devic':54B 'dlna':19B,111C 'expos':33B 'factorydefault':104C 'firmwar':31B,75C 'hisens':1A,20B,27B,71C 'issu':99C 'lan':5A,95C 'lan-adjac':94C 'local':58B 'loop':127C 'miss':79C 'mute':64B,139C 'network':59B 'one':50B,109C 'one-tim':49B,108C 'overrid':132C 'pair':52B,112C 'per':44B,116C 'per-command':43B,115C 'physic':134C 'pictur':67B,143C 'port':40B,89C 'remot':135C 'renderingcontrol':36B,85C 'reset':11A,66B,141C 'selectpreset':103C 'send':124C 'servic':37B,86C 'session':120C 'set':12A,147C 'setmut':101C 'setvolum':100C 'smart':3A,23B,29B,73C 'smart-tv':22B 'tcp':39B,88C 'time':51B,110C 'token':121C 'tv':4A,24B,30B,74C 'unauthent':129C 'upnp':25B 'upnp/dlna':35B,84C 'v0000.01.00a.p0220':32B,76C 'vidaa':2A,26B,28B,72C 'volum':9A,62B,137C 'vulner':81C 'without':42B","nicknames":[],"mitigations":[],"who_affected":"Owners of Hisense VIDAA smart TVs running firmware V0000.01.00a.P0220 are exposed when another device on their local network can reach TCP port 38400. The sources do not say whether other firmware versions or models are affected, and the sources do not describe a fix. Households and offices whose TVs sit on an isolated network are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dlna","hisense","medium","other","smarttv","upnp","vidaa"],"campaign_type":null,"search_a":"'-123996':15A,18A '-2026':14A,17A 'attack':6A 'chang':8A 'cve':13A,16A 'hisens':1A 'lan':5A 'reset':11A 'set':12A 'smart':3A 'tv':4A 'vidaa':2A 'volum':9A","search_b":"'38400':41B 'audio':69B 'authent':46B 'calibr':70B 'chang':61B 'command':45B 'devic':54B 'dlna':19B 'expos':33B 'firmwar':31B 'hisens':20B,27B 'local':58B 'mute':64B 'network':59B 'one':50B 'one-tim':49B 'pair':52B 'per':44B 'per-command':43B 'pictur':67B 'port':40B 'renderingcontrol':36B 'reset':66B 'servic':37B 'smart':23B,29B 'smart-tv':22B 'tcp':39B 'time':51B 'tv':24B,30B 'upnp':25B 'upnp/dlna':35B 'v0000.01.00a.p0220':32B 'vidaa':26B,28B 'volum':62B 'without':42B","search_c":"'38400':90C 'adjac':96C 'allow':92C 'attack':97C,122C 'audio':145C 'authent':80C,118C 'calibr':146C 'chang':136C 'command':105C,117C,130C 'contain':77C 'continu':126C 'dlna':111C 'factorydefault':104C 'firmwar':75C 'hisens':71C 'issu':99C 'lan':95C 'lan-adjac':94C 'loop':127C 'miss':79C 'mute':139C 'one':109C 'one-tim':108C 'overrid':132C 'pair':112C 'per':116C 'per-command':115C 'physic':134C 'pictur':143C 'port':89C 'remot':135C 'renderingcontrol':85C 'reset':141C 'selectpreset':103C 'send':124C 'servic':86C 'session':120C 'set':147C 'setmut':101C 'setvolum':100C 'smart':73C 'tcp':88C 'time':110C 'token':121C 'tv':74C 'unauthent':129C 'upnp/dlna':84C 'v0000.01.00a.p0220':76C 'vidaa':72C 'volum':137C 'vulner':81C","first_public_at":"2026-11-06T19:17:45+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123996","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123996","severity":null,"published_at":"2026-11-06T19:17:45+00:00","modified_at":"2026-11-06T19:17:45+00:00","first_seen_at":"2026-11-06T19:43:48+00:00","fetched_at":"2026-11-06T19:43:48+00:00","note":null}],"documents":[{"id":89349,"url":"https://www.vulncheck.com/advisories/hisense-vidaa-smart-tv-upnp-dlna-missing-authentication","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}