CVE-2026-123994Medium· 6.3▾ SunlitHisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an unauthenticated access vulnerability in the DIAL (Discovery and Launch) service on TCP port 56789, which accepts control requests from any LAN-adjacent device without authent…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 34.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an unauthenticated access vulnerability in the DIAL (Discovery and Launch) service on TCP port 56789, which accepts control requests from any LAN-adjacent device without authentication, pairing, or user notification. Attackers can query running application states, enumerate installed applications via HTTP response codes, terminate active sessions with a DELETE request, and launch applications or bypass YouTube's Origin check by spoofing the Origin header to disclose viewing activity and subscriptions or disrupt device functionality.
VIDAA 0000.01.00a.P0220Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-123996Medium· 4.6Hisense VIDAA Smart TV UPnP/DLNA Missing Authentication
CVE-2026-123995Medium· 4.6Hisense VIDAA Smart TV SSRF via SetAVTransportURI CurrentURI
CVE-2026-123993High· 8.8Hisense VIDAA Smart TV Unauthenticated WebDriver Remote Access
CVE-2026-123997Medium· 6.5Hisense VIDAA Smart TV Unauthenticated DoS via SetAVTransportURI
CVE-2026-123998High· 8.3Hisense VIDAA Smart TV MQTT Broker Authentication Bypass
CVE-2025-61777Critical· 9.4Flag Forge is a Capture The Flag (CTF) platform