CVE-2026-123995: Hisense VIDAA Smart TV SSRF via SetAVTransportURI CurrentURI

Published Nov 6, 2026

Updated

Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an input validation vulnerability in the UPnP/DLNA AVTransport SOAP service that allows a LAN-adjacent attacker to inject arbitrary URIs via the CurrentURI field of SetAVTransportURI without validating the scheme, host, or media legitimacy. Attackers can supply schemes such as http://, file:///data/misc/wifi/, rtsp://, or smb:// to have the TV fetch and render attacker-controlled content after a one-time DLNA pairing, enabling phishing pages, fake firmware prompts, and fake emergency alerts to be displayed, with subsequent commands executing silently.

Frequently Asked Questions

What does an attacker need before they can send malicious AVTransport commands?

The attacker must be LAN-adjacent and complete a one-time DLNA pairing with the TV. The affected interface is the UPnP/DLNA AVTransport SOAP service.

What can an attacker cause the TV to load after pairing?

They can supply arbitrary CurrentURI values, including http://, file:///data/misc/wifi/, rtsp://, and smb:// URIs, without validation of the scheme, host, or media legitimacy. This can cause attacker-controlled content such as phishing pages, fake firmware prompts, or fake emergency alerts to be rendered on the TV.

Are later actions visible to the person using the TV?

The reported behavior states that subsequent commands execute silently after the one-time DLNA pairing. This means visible attacker-controlled content may be followed by additional AVTransport commands without further user-facing prompts.

CVE-2026-123995: Hisense VIDAA Smart TV SSRF via SetAVTransportURI CurrentURI

Frequently Asked Questions

What does an attacker need before they can send malicious AVTransport commands?

What can an attacker cause the TV to load after pairing?

Are later actions visible to the person using the TV?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need before they can send malicious AVTransport commands?

What can an attacker cause the TV to load after pairing?

Are later actions visible to the person using the TV?