# CVE-2026-123995: Hisense VIDAA Smart TV input validation in UPnP AVTransport

Source: https://junglewise.ai/threats/cve-2026-123995-hisense-vidaa-smart-tv-firmware-v0000-01-00a-p0220-contains-an  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-06. Updated: 2026-11-06  
License: CC BY 4.0 with a link back

CVE-2026-123995 · Severity: medium · CVSS 4.6 · Published 2026-11-06

Hisense VIDAA Smart TVs contain a vulnerability in their media playback control service that runs on the local network. An attacker on the same network can trick the TV into displaying malicious content—such as phishing pages or fake firmware update prompts—by injecting arbitrary web addresses into the playback controls after the TV is first paired with a DLNA device. This could lead to credential theft or social engineering attacks against viewers.

Technologies: [Hisense VIDAA Smart TV](https://junglewise.ai/threats/technologies/vidaa-smart-tv). Vendors: [Hisense](https://junglewise.ai/threats/vendors/hisense).

## Quick answers

**Is CVE-2026-123995 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-123995 being exploited in the wild.

**How severe is CVE-2026-123995?** Medium severity, with a CVSS score of 4.6, published 6 November 2026.

**Which products and versions are affected?** Hisense VIDAA Smart TV V0000.01.00a.P0220 and earlier.

**Is there a fix for CVE-2026-123995?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-123995 attacked?** It is attacked from the adjacent network, in a network appliance.

**Am I affected by CVE-2026-123995?** Check whether you run Hisense VIDAA Smart TV at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The UPnP/DLNA AVTransport SOAP service on VIDAA firmware V0000.01.00a.P0220 fails to validate the scheme, host, or media type of URIs supplied in the SetAVTransportURI CurrentURI parameter. An unauthenticated network-adjacent attacker can inject URIs with arbitrary schemes (http://, file:///, rtsp://, smb://) to cause the TV to fetch and render attacker-controlled content after initial DLNA pairing. This allows phishing pages, fake emergency alerts, and firmware prompts to be presented on-screen.

## Affected products

- Hisense VIDAA Smart TV V0000.01.00a.P0220 and earlier

## Timeline

- 2026-11-06: disclosed

## References

- [https://github.com/yehia-mamdouh/Hisense-Smart-TV-Security-Research](https://github.com/yehia-mamdouh/Hisense-Smart-TV-Security-Research)
- [https://www.vulncheck.com/advisories/hisense-vidaa-smart-tv-ssrf-via-setavtransporturi-currenturi](https://www.vulncheck.com/advisories/hisense-vidaa-smart-tv-ssrf-via-setavtransporturi-currenturi)

## Related threats

- [Hisense VIDAA Smart TV authentication bypass in MQTT broker](https://junglewise.ai/threats/cve-2026-123998-hisense-vidaa-smart-tv-firmware-v0000-01-00a-p0220-contains-an)
- [Hisense VIDAA Smart TV denial of service in UPnP AVTransport](https://junglewise.ai/threats/cve-2026-123997-hisense-vidaa-smart-tv-firmware-v0000-01-00a-p0220-contains-an)
- [Hisense VIDAA Smart TV missing authentication in UPnP RenderingControl](https://junglewise.ai/threats/cve-2026-123996-hisense-vidaa-smart-tv-firmware-v0000-01-00a-p0220-contains-a)
- [Hisense VIDAA Smart TV DIAL service unauthenticated control access](https://junglewise.ai/threats/cve-2026-123994-hisense-vidaa-smart-tv-firmware-v0000-01-00a-p0220-contains-an)
- [Hisense VIDAA Smart TV unauthenticated WebDriver access](https://junglewise.ai/threats/cve-2026-123993-hisense-vidaa-smart-tv-firmware-v0000-01-00a-p0220-contains-an)