Description
Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains a missing authentication vulnerability in the UPnP/DLNA RenderingControl service on TCP port 38400 that allows a LAN-adjacent attacker to issue SetVolume, SetMute, and SelectPreset(FactoryDefaults) commands after a one-time DLNA pairing with no per-command authentication or session token. Attackers can send a continuous loop of unauthenticated commands to override the physical remote, change volume and mute, and reset all picture and audio calibration settings.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Hisense | VIDAA | 0000.01.00a.P0220 | — |
References
- Researcher Disclosure technical-description exploit
- VulnCheck Advisory: Hisense VIDAA Smart TV UPnP/DLNA Missing Authentication third-party-advisory