Hisense VIDAA Smart TV DIAL Service Unauthenticated Access

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an unauthenticated access vulnerability in the DIAL (Discovery and Launch) service on TCP port 56789, which accepts control requests from any LAN-adjacent device without authentication, pairing, or user notification. Attackers can query running application states, enumerate installed applications via HTTP response codes, terminate active sessions with a DELETE request, and launch applications or bypass YouTube's Origin check by spoofing the Origin header to disclose viewing activity and subscriptions or disrupt device functionality.

Etkilenen sürümler1 yazılım

Kaynaklar4 kaynak

• CVE.org kaydı
• NVD kaydı
• vulncheck.com/…a-smart-tv-dial-service-unauthenticated-access Üçüncü taraf
• github.com/yehia-mamdouh/Hisense-Smart-TV-Security-Research İstismar kodu ya da analiz

Kayıt geçmişi

1. 6 Kas 2026 21:55Yayımlandı

İlgili açıklar

• 8,3 CVE-2026-123998Hisense VIDAA Smart TV MQTT Broker Authentication Bypass
• 6,5 CVE-2026-123997Hisense VIDAA Smart TV Unauthenticated DoS via SetAVTransportURI
• 4,6 CVE-2026-123996Hisense VIDAA Smart TV UPnP/DLNA Missing Authentication
• 4,6 CVE-2026-123995Hisense VIDAA Smart TV SSRF via SetAVTransportURI CurrentURI
• 8,8 CVE-2026-123993Hisense VIDAA Smart TV Unauthenticated WebDriver Remote Access
• 8,1 CVE-2026-102344Lavish: DNS rebinding allows any website to read arbitrary local files and inject prompts into the AI agent via the unauthenticated local server