CVE-2026-123997 Hisense VIDAA Smart TV Unauthenticated DoS via SetAVTransportURI
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-123997?
CVE-2026-123997 is a high-severity vulnerability in Hisense VIDAA, published on 6 Nov 2026.
Official description
Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an unauthenticated denial-of-service vulnerability in the UPnP/DLNA AVTransport SOAP service that allows LAN-adjacent attackers to freeze the entire television software layer by sending a crafted SetAVTransportURI request on TCP port 38400. Attackers can exploit this flaw without credentials to render the device completely unresponsive to remote control or front-panel input, requiring a physical power cycle to restore functionality.
Weakness: CWE-770
Which versions are affected by CVE-2026-123997?
How do I fix CVE-2026-123997?
No fix has been published for CVE-2026-123997 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-123997 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-123997 exists.
Sources
Also known as GHSA-6pfw-v7rf-jx64.