Hisense has 6 CVEs on record. Disclosure cadence is accelerating: 6 in the last 90 days against 0 in the 90 before. The busiest recent month was November 2026 with 6. The median CVSS is 6.4 (medium). None have a confirmed exploitation report. The most common weakness class is CWE-306 (4).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.4
- Publish → KEV
- —
- Last 90 days
- 6 prev 0
Weakness classes
Products
- VIDAA 6
Worst active — by depth score
CVE-2026-123993High· 8.8Hisense VIDAA Smart TV Unauthenticated WebDriver Remote Access48CVE-2026-123998High· 8.3Hisense VIDAA Smart TV MQTT Broker Authentication Bypass46CVE-2026-123997Medium· 6.5Hisense VIDAA Smart TV Unauthenticated DoS via SetAVTransportURI36CVE-2026-123994Medium· 6.3Hisense VIDAA Smart TV DIAL Service Unauthenticated Access35CVE-2026-123996Medium· 4.6Hisense VIDAA Smart TV UPnP/DLNA Missing Authentication25
Hisense vulnerabilities
CVEs affecting Hisense, newest first. Open any entry for full detail, references, and exploit status.
6 CVEsRSS
CVE-2026-123996Medium· 4.6Hisense VIDAA Smart TV UPnP/DLNA Missing Authentication
Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains a missing authentication vulnerability in the UPnP/DLNA RenderingControl service on TCP port 38400 that allows a LAN-adjacent attacker to issue SetVolume, SetMute, and SelectPre…
CVE-2026-123995Medium· 4.6Hisense VIDAA Smart TV SSRF via SetAVTransportURI CurrentURI
Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an input validation vulnerability in the UPnP/DLNA AVTransport SOAP service that allows a LAN-adjacent attacker to inject arbitrary URIs via the CurrentURI field of SetAVTranspo…
CVE-2026-123998High· 8.3Hisense VIDAA Smart TV MQTT Broker Authentication Bypass
Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an authentication bypass vulnerability in its remote-control MQTT broker on TCP port 36669, which accepts publicly documented default credentials and an ineffective 4-digit pair…
CVE-2026-123997Medium· 6.5Hisense VIDAA Smart TV Unauthenticated DoS via SetAVTransportURI
Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an unauthenticated denial-of-service vulnerability in the UPnP/DLNA AVTransport SOAP service that allows LAN-adjacent attackers to freeze the entire television software layer by…
CVE-2026-123993High· 8.8Hisense VIDAA Smart TV Unauthenticated WebDriver Remote Access
Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an unauthenticated access vulnerability where a QA build of the Google Cobalt browser engine exposes the WebDriver automation server on TCP port 4444 across all network interfac…
CVE-2026-123994Medium· 6.3Hisense VIDAA Smart TV DIAL Service Unauthenticated Access
Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an unauthenticated access vulnerability in the DIAL (Discovery and Launch) service on TCP port 56789, which accepts control requests from any LAN-adjacent device without authent…