CVE-2026-15570
HIGH
MEDIUM
Priority: 0.02
BB Relevance:
59/100
Published: 2026-08-07
Modified: 2026-10-23
First seen: 2026-10-29
Status: active
Attack Surface
Adjacent
Low Complexity
No Auth
No Interaction
Integ. Impact
CVSS Vector Breakdown
AV:
Adjacent
AC:
Low
PR:
None
UI:
None
S:
X
AT:
None
VC:
None
VI:
High
VA:
Low
Description
An improper restriction of URL schemes and destinations in the SmartCenter browserseturl command in the Telefunken TE24553B45V2DZ Smart TV running on the Vestel MB181 / Voltron181 / TiVo OS platform allows an attacker with access to the same local network to cause the embedded browser to issue requests to unintended loopback/internal destinations, including 127.0.0.1 addresses. In demonstrated scenarios, requests initiated through the SmartCenter browserseturl mechanism could reach an internal service and receive a successful response, although the same destination was not reachable through normal browser navigation. The issue affects firmware version V2.78.0.0 and is fixed in firmware version V2.85.2.0.