VIDAA SMART TV FIRMWARE · CVE-2026-123998 · Infrastructure
NO FIX YET
Hisense VIDAA smart TV firmware V0000.01.00a.P0220 runs a remote-control MQTT broker on TCP port 36669 that accepts public default credentials and a 4-digit pairing PIN with no rate limiting, so the PIN can be brute-forced in about five seconds. Some actions need no pairing at all, letting a nearby attacker change volume, switch inputs, launch installed apps and watch pairing activity.
first public Nov 6, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Hisense VIDAA smart TVs running firmware V0000.01.00a.P0220 that are reachable from an untrusted local network, such as hotel rooms or shared office networks. The sources say the risk is significant in hotel deployments where untrusted LAN access is common. Devices on an isolated network or with port 36669 blocked are less exposed.
Not affected if isolated-network, other-firmware, port-36669-blocked
Who cares hisense, hotel-deployments, smart-tv, vidaa
Unknown from the sources.
Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an authentication bypass vulnerability in its remote-control MQTT broker on TCP port 36669, which accepts publicly documented default credentials and an ineffective 4-digit pairing PIN with no rate limiting or lockout, allowing a brute force of the entire code space in about five seconds, while some actions require no pairing at all. A LAN-adjacent attacker can exploit this to inject key events, change volume, switch input sources, enumerate inputs, launch arbitrary installed applications, and monitor pairing activity, posing a significant risk in hotel deployments where untrusted LAN access is common.
This page as .md · .json · CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.