CVE-2026-123998High· 8.3▾ TwilightHisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an authentication bypass vulnerability in its remote-control MQTT broker on TCP port 36669, which accepts publicly documented default credentials and an ineffective 4-digit pair…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 45.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an authentication bypass vulnerability in its remote-control MQTT broker on TCP port 36669, which accepts publicly documented default credentials and an ineffective 4-digit pairing PIN with no rate limiting or lockout, allowing a brute force of the entire code space in about five seconds, while some actions require no pairing at all. A LAN-adjacent attacker can exploit this to inject key events, change volume, switch input sources, enumerate inputs, launch arbitrary installed applications, and monitor pairing activity, posing a significant risk in hotel deployments where untrusted LAN access is common.
VIDAA 0000.01.00a.P0220Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-123996Medium· 4.6Hisense VIDAA Smart TV UPnP/DLNA Missing Authentication
CVE-2026-123995Medium· 4.6Hisense VIDAA Smart TV SSRF via SetAVTransportURI CurrentURI
CVE-2026-123997Medium· 6.5Hisense VIDAA Smart TV Unauthenticated DoS via SetAVTransportURI
CVE-2026-123993High· 8.8Hisense VIDAA Smart TV Unauthenticated WebDriver Remote Access
CVE-2026-123994Medium· 6.3Hisense VIDAA Smart TV DIAL Service Unauthenticated Access
CVE-2025-12547Low· 3.7A vulnerability was identified in LogicalDOC Community Edition up to 9.2.1