CVE-2026-15570: Improper URL Scheme and Destination Validation in SmartCenter browserseturl Command
An improper restriction of URL schemes and destinations in the SmartCenter browserseturl command in the Telefunken TE24553B45V2DZ Smart TV running on the Vestel MB181 / Voltron181 / TiVo OS platform allows an attacker with access to the same local network to cause the embedded browser to issue requests to unintended loopback/internal destinations, including 127.0.0.1 addresses. In demonstrated scenarios, requests initiated through the SmartCenter browserseturl mechanism could reach an internal service and receive a successful response, although the same destination was not reachable through normal browser navigation. The issue affects firmware version V2.78.0.0 and is fixed in firmware version V2.85.2.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Telefunken TE24553B45V2DZ Smart TV (Vestel MB181 / Voltron181 / TiVo OS)to a version that resolves this vulnerability.Fixed in V2.85.2.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15570?
The severity of CVE-2026-15570 is rated at 33.
What is CVE-2026-15570 about?
CVE-2026-15570 involves improper URL scheme and destination validation in the SmartCenter browserseturl command on specific Telefunken Smart TVs.
How do I fix CVE-2026-15570?
To fix CVE-2026-15570, ensure that the Smart TV firmware is updated to the latest version available from the manufacturer.
Who is affected by CVE-2026-15570?
CVE-2026-15570 affects users of the Telefunken TE24553B45V2DZ Smart TV and systems running on the Vestel MB181 / Voltron181 / TiVo OS platform.
What type of vulnerability is CVE-2026-15570?
CVE-2026-15570 is categorized as a Server-Side Request Forgery (SSRF) vulnerability.