{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/vidaa-smart-tv-firmware-v0000.01.00a.p0220/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:o:hisense:vidaa_smart_tv_firmware:v0000.01.00a.p0220:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.3,"id":"CVE-2026-123998"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["VIDAA Smart TV firmware (V0000.01.00a.P0220)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Hisense"],"content_html":"\u003cp\u003eHisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an authentication bypass vulnerability in its remote-control MQTT broker on TCP port 36669. The service accepts default credentials and an ineffective 4-digit pairing PIN with no rate limiting or account lockout, allowing the entire code space to be brute-forced in approximately five seconds. Furthermore, specific control actions require no authentication at all.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eA LAN-adjacent attacker can perform unauthorized actions, including injecting key events, changing volume, switching input sources, enumerating inputs, and launching arbitrary installed applications. The vulnerability poses a significant risk in deployments such as hotels where untrusted devices share a local network.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePerform network segmentation to isolate Smart TVs from primary corporate or guest data networks.\u003c/li\u003e\n\u003cli\u003eDisable remote control features if not required by the specific deployment.\u003c/li\u003e\n\u003cli\u003eMonitor for high-frequency traffic directed toward TCP port 36669 originating from non-authorized devices.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-06T21:28:58Z","date_published":"2026-11-06T21:28:58Z","id":"https://feed.craftedsignal.io/briefs/2026-11-hisense-vidaa-auth-bypass/","summary":"Hisense VIDAA Smart TV firmware version V0000.01.00a.P0220 contains an authentication bypass in the MQTT broker on TCP port 36669, allowing unauthorized remote control via brute force or unauthenticated commands.","title":"Hisense VIDAA Smart TV authentication bypass (CVE-2026-123998)","url":"https://feed.craftedsignal.io/briefs/2026-11-hisense-vidaa-auth-bypass/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:o:hisense:vidaa_firmware:v0000.01.00a.p0220:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-123993"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["VIDAA Smart TV firmware (V0000.01.00a.P0220)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Hisense"],"content_html":"\u003cp\u003eHisense VIDAA Smart TV firmware version V0000.01.00a.P0220 contains a vulnerability stemming from the inclusion of a QA build of the Google Cobalt browser engine. This build exposes a WebDriver automation server on TCP port 4444 across all network interfaces without requiring authentication or pairing.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eAn attacker on the same local network can interface with the exposed service to execute arbitrary JavaScript within the browser context. This allows for the exfiltration of sensitive localStorage data, including ad-service credentials, MAC addresses, location data, and ACR telemetry. Furthermore, the attacker can leverage the window.hisense native bridge to execute filesystem read/write operations and modify system-state.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all Hisense VIDAA Smart TV devices on the network to identify those running firmware version V0000.01.00a.P0220.\u003c/li\u003e\n\u003cli\u003eRestrict network access to the devices, specifically blocking incoming connections to TCP port 4444 from untrusted network segments.\u003c/li\u003e\n\u003cli\u003eMonitor network traffic for connections to port 4444 originating from unauthorized local IP addresses.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-06T21:28:53Z","date_published":"2026-11-06T21:28:53Z","id":"https://feed.craftedsignal.io/briefs/2026-11-hisense-vidaa-webdriver-access/","summary":"Hisense VIDAA Smart TV firmware version V0000.01.00a.P0220 exposes an unauthenticated WebDriver server on TCP port 4444, enabling local network attackers to execute arbitrary JavaScript and perform system-level operations via the native bridge.","title":"Hisense VIDAA Smart TV firmware: Unauthenticated WebDriver access (CVE-2026-123993)","url":"https://feed.craftedsignal.io/briefs/2026-11-hisense-vidaa-webdriver-access/"}],"language":"en","title":"CraftedSignal Threat Feed - VIDAA Smart TV Firmware (V0000.01.00a.P0220)","version":"https://jsonfeed.org/version/1.1"}