Dashboard / CVE-2026-123994

CVE-2026-123994

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 56/100
Published: 2026-11-06 Modified: 2026-11-12 First seen: 2026-11-06 Status: active

Attack Surface

Adjacent Low Complexity No Auth No Interaction

CVSS Vector Breakdown

AV: Adjacent
AC: Low
PR: None
UI: None
S: X
AT: None
VC: Low
VI: Low
VA: Low

Description

Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an unauthenticated access vulnerability in the DIAL (Discovery and Launch) service on TCP port 56789, which accepts control requests from any LAN-adjacent device without authentication, pairing, or user notification. Attackers can query running application states, enumerate installed applications via HTTP response codes, terminate active sessions with a DELETE request, and launch applications or bypass YouTube's Origin check by spoofing the Origin header to disclose viewing activity and subscriptions or disrupt device functionality.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
Hisense VIDAA 0000.01.00a.P0220
Hisense VIDAA 0000.01.00a.P0220

References & Advisories (2)

Bug Bounty Relevance

56 / 100
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

5.3 / 10.0 v4.0
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.20%
Raw Score 0.001960
Percentile 9.4%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00196
2026-11-12
0.00196
2026-11-10
0.00196
2026-11-09
0.00196
2026-11-08
0.00196
2026-11-07
0.00196

Intelligence Sources

mitre ref →
nvd ref →

External Links