Hisense VIDAA Smart TV SSRF via SetAVTransportURI CurrentURI

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an input validation vulnerability in the UPnP/DLNA AVTransport SOAP service that allows a LAN-adjacent attacker to inject arbitrary URIs via the CurrentURI field of SetAVTransportURI without validating the scheme, host, or media legitimacy. Attackers can supply schemes such as http://, file:///data/misc/wifi/, rtsp://, or smb:// to have the TV fetch and render attacker-controlled content after a one-time DLNA pairing, enabling phishing pages, fake firmware prompts, and fake emergency alerts to be displayed, with subsequent commands executing silently.

Etkilenen sürümler1 yazılım

Kaynaklar4 kaynak

• CVE.org kaydı
• NVD kaydı
• vulncheck.com/…smart-tv-ssrf-via-setavtransporturi-currenturi Üçüncü taraf
• github.com/yehia-mamdouh/Hisense-Smart-TV-Security-Research İstismar kodu ya da analiz

Kayıt geçmişi

1. 6 Kas 2026 21:57Yayımlandı

İlgili açıklar

• 8,3 CVE-2026-123998Hisense VIDAA Smart TV MQTT Broker Authentication Bypass
• 6,5 CVE-2026-123997Hisense VIDAA Smart TV Unauthenticated DoS via SetAVTransportURI
• 4,6 CVE-2026-123996Hisense VIDAA Smart TV UPnP/DLNA Missing Authentication
• 6,3 CVE-2026-123994Hisense VIDAA Smart TV DIAL Service Unauthenticated Access
• 8,8 CVE-2026-123993Hisense VIDAA Smart TV Unauthenticated WebDriver Remote Access
• 8,1 CVE-2026-102344Lavish: DNS rebinding allows any website to read arbitrary local files and inject prompts into the AI agent via the unauthenticated local server