CVE-2026-123994: Hisense VIDAA Smart TV DIAL Service Unauthenticated Access

Published Nov 6, 2026

Updated

Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an unauthenticated access vulnerability in the DIAL (Discovery and Launch) service on TCP port 56789, which accepts control requests from any LAN-adjacent device without authentication, pairing, or user notification. Attackers can query running application states, enumerate installed applications via HTTP response codes, terminate active sessions with a DELETE request, and launch applications or bypass YouTube's Origin check by spoofing the Origin header to disclose viewing activity and subscriptions or disrupt device functionality.

Event History

Nov 6, 2026

CVE Published

via MITRE·06:55 PM

Data Sourced

via MITRE·06:55 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any device that can reach the affected TV over the local network can send requests to TCP port 56789. The described service does not require authentication, pairing, or user notification.

Is user interaction or prior access to the TV required?

No. The DIAL service accepts control requests from LAN-adjacent devices without authentication or pairing, so an attacker does not need to interact with the TV user interface first.

What could indicate that a TV has been targeted?

Unexpected application launches, terminated active sessions, or abnormal disruption of device functionality may indicate abuse. The issue also permits querying application state and enumerating installed applications through HTTP response behavior.

What can be done when a firmware update is not immediately available?

Limit which devices can reach the TV on the local network, particularly TCP port 56789. Network segmentation or access controls that prevent untrusted LAN devices from contacting the TV reduce exposure.

CVE-2026-123994: Hisense VIDAA Smart TV DIAL Service Unauthenticated Access

Event History

Frequently Asked Questions

Who can exploit this issue?

Is user interaction or prior access to the TV required?

What could indicate that a TV has been targeted?

What can be done when a firmware update is not immediately available?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Is user interaction or prior access to the TV required?

What could indicate that a TV has been targeted?

What can be done when a firmware update is not immediately available?