CVE Alert: CVE-2026-123998 – Hisense

Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an authentication bypass vulnerability in its remote-control MQTT broker on TCP port 36669, which accepts publicly documented default credentials and an ineffective 4-digit pairing PIN with no rate limiting or lockout, allowing a brute force of the entire code space in five seconds, while some actions require no pairing at all. A LAN-adjacent attacker can exploit this to inject key events, change volume, switch input sources, enumerate inputs, launch arbitrary installed applications, and monitor pairing activity, posing a significant risk in hotel deployments where untrusted LAN access is common.

**Risk verdict:** High practical risk for TVs reachable from untrusted local networks; no active-exploitation flag is supplied, so urgency cannot be confirmed.

**Why this matters:** An attacker could manipulate TV functions, disrupt viewing, or launch installed applications, with potential reputational and operational impact in guest-facing environments. The supplied research reference is tagged as exploit-related, but that alone does not establish exploitation in the wild; KEV, SSVC, and EPSS data are absent.

**Most likely attack path:** The attacker needs adjacent network access, but low complexity, no required privileges, and no user interaction make exploitation straightforward once that access exists. Scope is unchanged, so the assessed impact is on the TV itself; compromised TVs may nevertheless provide a foothold for further activity if network segmentation is weak.

**Who is most exposed:** Hotels, hospitality venues, and other organisations connecting smart TVs to shared or guest-accessible LANs are most exposed; consumer networks with trusted-device isolation are less so.

Alert on unexpected connections to TVs’ MQTT service, particularly from guest or user subnets.

Review broker authentication failures and repeated pairing attempts.

Investigate unexplained input changes, application launches, or pairing activity.

Mitigation and prioritisation

Confirm affected device and firmware status with the vendor; apply a vendor-approved fix as soon as available.

Until fixed, block access to the broker from untrusted networks and isolate TVs on restricted VLANs.

Disable remote-control or broker functionality where operationally feasible.

Test controls on representative devices before broad deployment; monitor for service disruption after changes.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.