CVE-2026-123995 Hisense VIDAA Smart TV SSRF via SetAVTransportURI CurrentURI
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-123995?
CVE-2026-123995 is a medium-severity vulnerability in Hisense VIDAA, published on 6 Nov 2026.
Official description
Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an input validation vulnerability in the UPnP/DLNA AVTransport SOAP service that allows a LAN-adjacent attacker to inject arbitrary URIs via the CurrentURI field of SetAVTransportURI without validating the scheme, host, or media legitimacy. Attackers can supply schemes such as http://, file:///data/misc/wifi/, rtsp://, or smb:// to have the TV fetch and render attacker-controlled content after a one-time DLNA pairing, enabling phishing pages, fake firmware prompts, and fake emergency alerts to be displayed, with subsequent commands executing silently.
Which versions are affected by CVE-2026-123995?
How do I fix CVE-2026-123995?
No fix has been published for CVE-2026-123995 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-123995 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-123995 exists.
Sources
Also known as GHSA-32qr-wwq4-8qhm.