CVE-2026-123998 Hisense VIDAA Smart TV MQTT Broker Authentication Bypass
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-123998?
CVE-2026-123998 is a high-severity vulnerability in Hisense VIDAA, published on 6 Nov 2026.
Official description
Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an authentication bypass vulnerability in its remote-control MQTT broker on TCP port 36669, which accepts publicly documented default credentials and an ineffective 4-digit pairing PIN with no rate limiting or lockout, allowing a brute force of the entire code space in about five seconds, while some actions require no pairing at all. A LAN-adjacent attacker can exploit this to inject key events, change volume, switch input sources, enumerate inputs, launch arbitrary installed applications, and monitor pairing activity, posing a significant risk in hotel deployments where untrusted LAN access is common.
Which versions are affected by CVE-2026-123998?
How do I fix CVE-2026-123998?
No fix has been published for CVE-2026-123998 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-123998 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-123998 exists.
Sources
Also known as GHSA-hjch-8qgq-882h.