Six security vulnerabilities have been disclosed in Hisense smart TVs running the VIDAA operating system, allowing an attacker on the same local network to monitor and control the device. Independent researcher Yehia Elghaly (Mrvar0x) tested the 55A57EXVT model with firmware V0000.01.00a.P0220. The findings were assigned identifiers from CVE-2026-123993 through CVE-2026-123998.
The researcher reported the vulnerabilities to Hisense on April 27, 2026, and sent a reminder on May 2. As of October 30, 2026, the company had provided neither confirmation nor any information about a fix. So at the moment, there is no published patch.
WebDriver server exposed to the local network
The most serious finding involves a test build of the Google Cobalt browser engine making its way into production firmware. Cobalt 19.lts.5.205289-qa runs a WebDriver automation server on TCP port 4444 across all network interfaces without requiring any authentication. Anyone with network access can use this port to execute JavaScript in the browser context.
The practical impact is serious. ACR telemetry, MAC addresses, ad service credentials, and location data stored in the TV’s browser storage can be read and exfiltrated. An attacker can display persistent content on the screen and use the local bridge called window.hisense to perform file system read/write operations and system state actions. The CVSS 3.1 score is 8.8, and the CVSS 4.0 score is 8.7. The weakness classes are CWE-306 and CWE-489, meaning critical functionality without authentication and debug code left in production.
MQTT remote control opens with default credentials
The second finding is in the MQTT broker that carries remote control traffic. The service on TCP port 36669 accepts publicly documented default credentials. There is no attempt limit or lockout for the four-digit PIN used during pairing; the researcher was able to make 7,005 attempts in 16.7 seconds. Some commands do not even require pairing.
From there, it is possible to inject key events, change the volume, switch the input source, and launch installed apps. The CVSS 3.1 score is 8.3. The risk is higher in deployments where untrusted clients share the same network, such as hotel rooms.
Four findings on the DIAL, DLNA, and UPnP side
The remaining four vulnerabilities affect the TV’s app and media services. The DIAL service on port 56789 allows querying app status, launching apps, and stopping them. The DLNA and UPnP AVTransport service on port 38400 can send unwanted media to the screen and change the volume.
It is also possible to completely freeze the TV through the same service with a single request. The researcher noted that the device stopped responding to both the remote and the power button, and did not recover without being unplugged and plugged back in. Worse, SOAP commands continue to work even while the permission prompt is visible on screen.
What you can do
Since there is no patch, mitigation has to happen on the network side. Isolate the TV from the network used by devices you trust; a guest network or a separate IoT VLAN will help. On the router, block client-to-client and external access to ports 4444, 36669, 56789, and 38400. In places like hotels, cafes, and showrooms, do not put these devices on the customer network at all.
One limitation should also be stated clearly. The attacker needs network access to the TV; this is not a random attack scenario coming from the internet. The risk grows if a device on the same Wi-Fi is compromised. The findings apply to a single test device and firmware version, and cannot be generalized to all Hisense models.
Source: VulnCheck · research repository
Share your experience
Bir sorunun, farklı bir çözümün veya eklemek istediğin bir notun var mı? Giriş yapmadan da yazabilirsin.