{"id":"CVE-2026-123998","kind":"vulnerability","aliases":["CVE-2026-123998"],"related":[],"title":"Hisense VIDAA smart TV: MQTT remote broker bypassed with default credentials and weak PIN","description":"Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an authentication bypass vulnerability in its remote-control MQTT broker on TCP port 36669, which accepts publicly documented default credentials and an ineffective 4-digit pairing PIN with no rate limiting or lockout, allowing a brute force of the entire code space in about five seconds, while some actions require no pairing at all. A LAN-adjacent attacker can exploit this to inject key events, change volume, switch input sources, enumerate inputs, launch arbitrary installed applications, and monitor pairing activity, posing a significant risk in hotel deployments where untrusted LAN access is common.","summary":"Hisense VIDAA smart TV firmware V0000.01.00a.P0220 runs a remote-control MQTT broker on TCP port 36669 that accepts public default credentials and a 4-digit pairing PIN with no rate limiting, so the PIN can be brute-forced in about five seconds. Some actions need no pairing at all, letting a nearby attacker change volume, switch inputs, launch installed apps and watch pairing activity.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"VIDAA smart TV firmware","fixed":[],"affected":"<= V0000.01.00a.P0220","ecosystem":"vendor"}],"ecosystems":[],"tags":["hisense","hotel-deployments","infrastructure","smart-tv","vidaa"],"not_affected_if":["isolated-network","other-firmware","port-36669-blocked"],"how_to_check":"- Check the TV firmware version in settings; the VulnCheck advisory lists V0000.01.00a.P0220 and earlier (written as <= 0000.01.00a.P0220).\n- From another device on the same network, test whether TCP port 36669 is open on the TV (for example: nc -zv <tv-ip> 36669).\n- Hotels and shared networks: also check that guest devices cannot reach TVs (client isolation / VLAN).","fix":null,"status":"open","published_at":"2026-11-06T19:17:45+00:00","first_seen_at":"2026-11-06T19:43:48+00:00","triaged_at":"2026-11-06T19:45:51+00:00","updated_at":"2026-11-06T19:46:46+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-06T19:45:51Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Hisense VIDAA smart TV: MQTT remote broker bypassed with default credentials and weak PIN","impact":"medium","summary":"Hisense VIDAA smart TV firmware V0000.01.00a.P0220 runs a remote-control MQTT broker on TCP port 36669 that accepts public default credentials and a 4-digit pairing PIN with no rate limiting, so the PIN can be brute-forced in about five seconds. Some actions need no pairing at all, letting a nearby attacker change volume, switch inputs, launch installed apps and watch pairing activity.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["hisense","vidaa","smart-tv","hotel-deployments"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"nearby attacker controls TV and launches installed apps","analyst_note":"Confirm fixed firmware version and vendor advisory from the VulnCheck third-party advisory at www.vulncheck.com; the sources give no fix.","how_to_check":"- Check whether the TV's firmware is `V0000.01.00a.P0220` in the TV's settings or model record\n- Check whether TCP port `36669` is reachable from other devices on the local network\n- unknown for anything beyond these","plain_action":"Check whether your Hisense VIDAA TV runs firmware V0000.01.00a.P0220 and wait for the vendor's update; the sources do not state a fix yet.","needs_analyst":true,"not_affected_if":["other-firmware","isolated-network","port-36669-blocked"],"who_is_affected":"Hisense VIDAA smart TVs running firmware V0000.01.00a.P0220 that are reachable from an untrusted local network, such as hotel rooms or shared office networks. The sources say the risk is significant in hotel deployments where untrusted LAN access is common. Devices on an isolated network or with port 36669 blocked are less exposed.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000803,"input_tokens":4383,"output_tokens":729,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm fixed firmware version and vendor advisory from the VulnCheck third-party advisory at www.vulncheck.com; the sources give no fix.","search":"'-123998':17A,20A '-2026':16A,19A '36669':50B,121C '4':58B,131C 'accept':52B,123C 'access':199C 'action':79B,156C 'activ':99B,188C 'adjac':165C 'allow':141C 'app':95B 'applic':184C 'arbitrari':182C 'attack':88B,166C 'authent':108C 'broker':7A,46B,117C 'brute':72B,143C 'brute-forc':71B 'bypass':8A,109C 'chang':89B,174C 'code':148C 'common':201C 'contain':106C 'control':44B,115C 'credenti':11A,55B,127C 'cve':15A,18A 'default':10A,54B,126C 'deploy':28B,195C 'digit':59B,132C 'document':125C 'entir':147C 'enumer':179C 'event':173C 'exploit':168C 'firmwar':38B,104C 'firmware':24A 'five':76B,152C 'forc':73B,144C 'hisens':1A,25B,34B,100C 'hotel':27B,194C 'hotel-deploy':26B 'ineffect':130C 'infrastructur':29B 'inject':171C 'input':92B,177C,180C 'instal':94B,183C 'key':172C 'lan':164C,198C 'lan-adjac':163C 'launch':93B,181C 'let':85B 'limit':65B,138C 'lockout':140C 'monitor':186C 'mqtt':5A,45B,116C 'nearbi':87B 'need':80B 'pair':60B,82B,98B,133C,159C,187C 'pin':14A,61B,68B,134C 'port':49B,120C 'pose':189C 'public':53B,124C 'rate':64B,137C 'remot':6A,43B,114C 'remote-control':42B,113C 'requir':157C 'risk':192C 'run':40B 'second':77B,153C 'signific':191C 'smart':3A,22A,31B,36B,102C 'smart-tv':30B 'sourc':178C 'space':149C 'switch':91B,176C 'tcp':48B,119C 'tv':4A,23A,32B,37B,103C 'untrust':197C 'v0000.01.00a.p0220':39B,105C 'vidaa':2A,21A,33B,35B,101C 'volum':90B,175C 'vulner':110C 'watch':97B 'weak':13A","nicknames":[],"mitigations":[],"who_affected":"Hisense VIDAA smart TVs running firmware V0000.01.00a.P0220 that are reachable from an untrusted local network, such as hotel rooms or shared office networks. The sources say the risk is significant in hotel deployments where untrusted LAN access is common. Devices on an isolated network or with port 36669 blocked are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"everyone","plain_action":"If you have a Hisense TV, avoid connecting it to shared or untrusted Wi-Fi such as hotel networks until Hisense publishes an update; no update has been announced yet.","pkeys":["smarttvfirmware","vidaasmarttvfirmware"],"ptokens":["firmware","smart","tv","vidaa"],"labels":["high","hisense","hoteldeployments","infrastructure","smarttv","vidaa"],"campaign_type":null,"search_a":"'-123998':17A,20A '-2026':16A,19A 'broker':7A 'bypass':8A 'credenti':11A 'cve':15A,18A 'default':10A 'firmware':24A 'hisens':1A 'mqtt':5A 'pin':14A 'remot':6A 'smart':3A,22A 'tv':4A,23A 'vidaa':2A,21A 'weak':13A","search_b":"'36669':50B '4':58B 'accept':52B 'action':79B 'activ':99B 'app':95B 'attack':88B 'broker':46B 'brute':72B 'brute-forc':71B 'chang':89B 'control':44B 'credenti':55B 'default':54B 'deploy':28B 'digit':59B 'firmwar':38B 'five':76B 'forc':73B 'hisens':25B,34B 'hotel':27B 'hotel-deploy':26B 'infrastructur':29B 'input':92B 'instal':94B 'launch':93B 'let':85B 'limit':65B 'mqtt':45B 'nearbi':87B 'need':80B 'pair':60B,82B,98B 'pin':61B,68B 'port':49B 'public':53B 'rate':64B 'remot':43B 'remote-control':42B 'run':40B 'second':77B 'smart':31B,36B 'smart-tv':30B 'switch':91B 'tcp':48B 'tv':32B,37B 'v0000.01.00a.p0220':39B 'vidaa':33B,35B 'volum':90B 'watch':97B","search_c":"'36669':121C '4':131C 'accept':123C 'access':199C 'action':156C 'activ':188C 'adjac':165C 'allow':141C 'applic':184C 'arbitrari':182C 'attack':166C 'authent':108C 'broker':117C 'brute':143C 'bypass':109C 'chang':174C 'code':148C 'common':201C 'contain':106C 'control':115C 'credenti':127C 'default':126C 'deploy':195C 'digit':132C 'document':125C 'entir':147C 'enumer':179C 'event':173C 'exploit':168C 'firmwar':104C 'five':152C 'forc':144C 'hisens':100C 'hotel':194C 'ineffect':130C 'inject':171C 'input':177C,180C 'instal':183C 'key':172C 'lan':164C,198C 'lan-adjac':163C 'launch':181C 'limit':138C 'lockout':140C 'monitor':186C 'mqtt':116C 'pair':133C,159C,187C 'pin':134C 'port':120C 'pose':189C 'public':124C 'rate':137C 'remot':114C 'remote-control':113C 'requir':157C 'risk':192C 'second':153C 'signific':191C 'smart':102C 'sourc':178C 'space':149C 'switch':176C 'tcp':119C 'tv':103C 'untrust':197C 'v0000.01.00a.p0220':105C 'vidaa':101C 'volum':175C 'vulner':110C","first_public_at":"2026-11-06T19:17:45+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123998","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123998","severity":null,"published_at":"2026-11-06T19:17:45+00:00","modified_at":"2026-11-06T19:17:45+00:00","first_seen_at":"2026-11-06T19:43:48+00:00","fetched_at":"2026-11-06T19:43:48+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-123998:1923","url":null,"severity":null,"published_at":"2026-11-06T19:46:46+00:00","modified_at":"2026-11-06T19:46:46+00:00","first_seen_at":"2026-11-06T19:46:46+00:00","fetched_at":"2026-11-06T19:46:46+00:00","note":"Read VulnCheck advisory (third-party, credits Yehia Elghaly). It names no fixed firmware and no Hisense advisory; found none by search. Set fix_status unknown (was none with no vendor page). Affected = <= V0000.01.00a.P0220 per VulnCheck only. Nothing verified: no vendor source. VulnCheck CVSS 7.2 (v4) vs record 8.3; left severity. No exploitation or PoC found. X not checked. Settle: Hisense/VIDAA advisory or firmware release notes."}],"documents":[{"id":89351,"url":"https://www.vulncheck.com/advisories/hisense-vidaa-smart-tv-mqtt-broker-authentication-bypass","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}