CVE-2026-123998: Authentication Bypass in Hisense VIDAA Smart TVs
Article Content
- •CVE-2026-123998 affects Hisense VIDAA Smart TVs with firmware V0000.01.00a.P0220.
- •The vulnerability allows LAN-adjacent attackers to bypass authentication and control TV functions.
- •High risk for hotels and shared networks; mitigation includes isolating devices and monitoring access.
Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 has an authentication bypass vulnerability (CVE-2026-123998) in its remote-control MQTT broker on TCP port 36669. This flaw allows LAN-adjacent attackers to exploit weak default credentials and a 4-digit pairing PIN, enabling brute-force attacks in seconds. Affected systems can be manipulated to change volume, switch inputs, or launch applications, posing significant risks in environments like hotels where untrusted LAN access is common. The vulnerability has a CVSS score of 7.2, indicating a high severity but no active exploitation has been confirmed. Organizations are advised to isolate affected devices and monitor for suspicious activity. A vendor-approved fix is pending, and until then, blocking access from untrusted networks is recommended.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Following this threat?
Track CVE-2026-123998 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed