Hisense VIDAA Smart TV authentication bypass (CVE-2026-123998)

Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an authentication bypass vulnerability in its remote-control MQTT broker on TCP port 36669. The service accepts default credentials and an ineffective 4-digit pairing PIN with no rate limiting or account lockout, allowing the entire code space to be brute-forced in approximately five seconds. Furthermore, specific control actions require no authentication at all.

Impact

A LAN-adjacent attacker can perform unauthorized actions, including injecting key events, changing volume, switching input sources, enumerating inputs, and launching arbitrary installed applications. The vulnerability poses a significant risk in deployments such as hotels where untrusted devices share a local network.

Recommendation

• Perform network segmentation to isolate Smart TVs from primary corporate or guest data networks.
• Disable remote control features if not required by the specific deployment.
• Monitor for high-frequency traffic directed toward TCP port 36669 originating from non-authorized devices.