{"id":"CVE-2026-123997","kind":"vulnerability","aliases":["CVE-2026-123997"],"related":[],"title":"Hisense VIDAA smart TV: crafted UPnP request freezes the whole TV","description":"Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an unauthenticated denial-of-service vulnerability in the UPnP/DLNA AVTransport SOAP service that allows LAN-adjacent attackers to freeze the entire television software layer by sending a crafted SetAVTransportURI request on TCP port 38400. Attackers can exploit this flaw without credentials to render the device completely unresponsive to remote control or front-panel input, requiring a physical power cycle to restore functionality.","summary":"VulnCheck reports that Hisense VIDAA smart TV firmware V0000.01.00a.P0220 and earlier can be frozen by a crafted SetAVTransportURI request to the UPnP/DLNA AVTransport service on TCP port 38400. Someone on the same local network needs no credentials; the TV stays unresponsive until it is power-cycled. No vendor advisory or fix has been found yet.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"VIDAA smart TV firmware","fixed":[],"affected":"<= V0000.01.00a.P0220","ecosystem":"vendor"}],"ecosystems":[],"tags":["dlna","hisense","home-network","infrastructure","smart-tv","upnp","vidaa"],"not_affected_if":["no-local-untrusted-devices","other-firmware"],"how_to_check":"- On the TV, open Settings > Support > System Update (or About) and read the firmware version; V0000.01.00a.P0220 or older is named by VulnCheck.\n- From another device on the same network, check whether the TV accepts connections on TCP port 38400 (UPnP/DLNA AVTransport).\n- Hisense has not published a fixed version we could find: run Settings > Support > System Update > Check Firmware Update and install anything offered.","fix":"No fixed firmware version published in the sources read; unknown. Install any VIDAA update offered and keep the TV off guest/untrusted networks.","status":"open","published_at":"2026-11-06T19:17:45+00:00","first_seen_at":"2026-11-06T19:43:48+00:00","triaged_at":"2026-11-06T19:45:56+00:00","updated_at":"2026-11-06T19:46:47+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-06T19:45:56Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Hisense VIDAA smart TV: crafted UPnP request freezes the whole TV","impact":"low","summary":"Hisense VIDAA smart TV firmware V0000.01.00a.P0220 has a UPnP/DLNA AVTransport SOAP service that a crafted SetAVTransportURI request on TCP port 38400 can crash. An attacker on the same local network can freeze the TV until someone power-cycles it, with no credentials needed.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["hisense","vidaa","smart-tv","upnp","dlna","home-network"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Television software freezes and needs a physical power cycle to recover","analyst_note":"Confirm the fixed firmware version and whether Hisense has issued a patch; check the VulnCheck advisory linked in the sources.","how_to_check":"- Check whether the TV's firmware reads `V0000.01.00a.P0220` in the system settings\n- Check whether the TV answers on TCP port `38400` from another device on the same network\n- Check whether the TV exposes UPnP/DLNA media renderer services to the local network","plain_action":"If you own a Hisense VIDAA smart TV, check its firmware version in settings and watch for an update from Hisense; the sources do not name a fixed version.","needs_analyst":true,"not_affected_if":["other-firmware","no-local-untrusted-devices"],"who_is_affected":"Hisense VIDAA smart TVs running firmware V0000.01.00a.P0220 that expose the UPnP/DLNA AVTransport service on the local network. Devices on a network with no untrusted users or guest access are at much lower risk, and TVs not running this firmware are not named.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000771,"input_tokens":4337,"output_tokens":674,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed firmware version and whether Hisense has issued a patch; check the VulnCheck advisory linked in the sources.","search":"'-123997':14A,17A '-2026':13A,16A '38400':60B,131C 'adjac':113C 'advisori':82B 'allow':110C 'attack':114C,132C 'avtransport':55B,106C 'complet':143C 'contain':95C 'control':147C 'craft':5A,49B,125C 'credenti':69B,138C 'cve':12A,15A 'cycl':79B,157C 'denial':99C 'denial-of-servic':98C 'devic':142C 'dlna':22B 'earlier':43B 'entir':118C 'exploit':134C 'firmwar':40B,93C 'firmware':21A 'fix':84B 'flaw':136C 'found':87B 'freez':8A,116C 'front':150C 'front-panel':149C 'frozen':46B 'function':160C 'hisens':1A,23B,36B,89C 'home':25B 'home-network':24B 'infrastructur':27B 'input':152C 'lan':112C 'lan-adjac':111C 'layer':121C 'local':65B 'need':67B 'network':26B,66B 'panel':151C 'physic':155C 'port':59B,130C 'power':78B,156C 'power-cycl':77B 'remot':146C 'render':140C 'report':34B 'request':7A,51B,127C 'requir':153C 'restor':159C 'send':123C 'servic':56B,101C,108C 'setavtransporturi':50B,126C 'smart':3A,19A,29B,38B,91C 'smart-tv':28B 'soap':107C 'softwar':120C 'someon':61B 'stay':72B 'tcp':58B,129C 'televis':119C 'tv':4A,11A,20A,30B,39B,71B,92C 'unauthent':97C 'unrespons':73B,144C 'upnp':6A,31B 'upnp/dlna':54B,105C 'v0000.01.00a.p0220':41B,94C 'vendor':81B 'vidaa':2A,18A,32B,37B,90C 'vulncheck':33B 'vulner':102C 'whole':10A 'without':137C 'yet':88B","nicknames":[],"mitigations":[],"who_affected":"Hisense VIDAA smart TVs running firmware V0000.01.00a.P0220 that expose the UPnP/DLNA AVTransport service on the local network. Devices on a network with no untrusted users or guest access are at much lower risk, and TVs not running this firmware are not named.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"If you own a Hisense VIDAA smart TV, check its firmware version in settings and watch for an update from Hisense; the sources do not name a fixed version.","pkeys":["smarttvfirmware","vidaasmarttvfirmware"],"ptokens":["firmware","smart","tv","vidaa"],"labels":["dlna","high","hisense","homenetwork","infrastructure","smarttv","upnp","vidaa"],"campaign_type":null,"search_a":"'-123997':14A,17A '-2026':13A,16A 'craft':5A 'cve':12A,15A 'firmware':21A 'freez':8A 'hisens':1A 'request':7A 'smart':3A,19A 'tv':4A,11A,20A 'upnp':6A 'vidaa':2A,18A 'whole':10A","search_b":"'38400':60B 'advisori':82B 'avtransport':55B 'craft':49B 'credenti':69B 'cycl':79B 'dlna':22B 'earlier':43B 'firmwar':40B 'fix':84B 'found':87B 'frozen':46B 'hisens':23B,36B 'home':25B 'home-network':24B 'infrastructur':27B 'local':65B 'need':67B 'network':26B,66B 'port':59B 'power':78B 'power-cycl':77B 'report':34B 'request':51B 'servic':56B 'setavtransporturi':50B 'smart':29B,38B 'smart-tv':28B 'someon':61B 'stay':72B 'tcp':58B 'tv':30B,39B,71B 'unrespons':73B 'upnp':31B 'upnp/dlna':54B 'v0000.01.00a.p0220':41B 'vendor':81B 'vidaa':32B,37B 'vulncheck':33B 'yet':88B","search_c":"'38400':131C 'adjac':113C 'allow':110C 'attack':114C,132C 'avtransport':106C 'complet':143C 'contain':95C 'control':147C 'craft':125C 'credenti':138C 'cycl':157C 'denial':99C 'denial-of-servic':98C 'devic':142C 'entir':118C 'exploit':134C 'firmwar':93C 'flaw':136C 'freez':116C 'front':150C 'front-panel':149C 'function':160C 'hisens':89C 'input':152C 'lan':112C 'lan-adjac':111C 'layer':121C 'panel':151C 'physic':155C 'port':130C 'power':156C 'remot':146C 'render':140C 'request':127C 'requir':153C 'restor':159C 'send':123C 'servic':101C,108C 'setavtransporturi':126C 'smart':91C 'soap':107C 'softwar':120C 'tcp':129C 'televis':119C 'tv':92C 'unauthent':97C 'unrespons':144C 'upnp/dlna':105C 'v0000.01.00a.p0220':94C 'vidaa':90C 'vulner':102C 'without':137C","first_public_at":"2026-11-06T19:17:45+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123997","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123997","severity":null,"published_at":"2026-11-06T19:17:45+00:00","modified_at":"2026-11-06T19:17:45+00:00","first_seen_at":"2026-11-06T19:43:48+00:00","fetched_at":"2026-11-06T19:43:48+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-123997:1924","url":null,"severity":null,"published_at":"2026-11-06T19:46:47+00:00","modified_at":"2026-11-06T19:46:47+00:00","first_seen_at":"2026-11-06T19:46:47+00:00","fetched_at":"2026-11-06T19:46:47+00:00","note":"Read VulnCheck advisory (third-party; credits researcher Yehia Elghaly). It lists VIDAA <= 0000.01.00a.P0220 as affected. No Hisense/VIDAA advisory or fixed firmware found, so fix stays unknown and nothing is verified. A vendor statement would settle it (VIDAA disclosure policy page: vidaa.com/vidaa-usa-inc-vulnerability-disclosure-policy). No exploitation or PoC seen."}],"documents":[{"id":89350,"url":"https://www.vulncheck.com/advisories/hisense-vidaa-smart-tv-unauthenticated-dos-via-setavtransporturi","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}