Hisense VIDAA Smart TV Unauthenticated WebDriver Remote Access
Affects Hisense VIDAA smart TV firmware V0000.01.00a.P0220 and earlier when a QA build of the Google Cobalt browser engine exposes WebDriver on TCP port 4444 across all network interfaces.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- No fix listed
- Who is exposed
- Not reported
Do first: Workaround: The checked facts list no workaround. The exposure depends on the WebDriver server being reachable across all network interfaces on TCP port 4444, so limiting that reachability is the only mitigation the facts point to, and no source confirms it.
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 14/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Hisense VIDAA Smart TVs run a QA build of the Cobalt browser engine that leaves its WebDriver automation service open on TCP port 4444 across all network interfaces, with no authentication or pairing, so an attacker on the same local network can connect without logging in. Through that service, the attacker can run arbitrary JavaScript, read and steal sensitive data such as ACR telemetry, MAC addresses, ad-service credentials, and location data, inject persistent content onto the display, and use the window.hisense native bridge to read and write files and change system state.
Read the original description
Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an unauthenticated access vulnerability where a QA build of the Google Cobalt browser engine exposes the WebDriver automation server on TCP port 4444 across all network interfaces without any authentication or pairing requirement. A LAN-adjacent attacker can connect to the exposed WebDriver service to execute arbitrary JavaScript, read and exfiltrate sensitive localStorage data including ACR telemetry, MAC addresses, ad-service credentials, and location data, inject persistent content onto the display, and access the window.hisense native bridge to perform filesystem read/write and system-state operations.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure?/25Unknown. Advisories don't say whether default setups are affected
- Reach?/20Unknown. No tracked technology or package matched
- Severity8.7/10CVSS 8.7
- No patch5/5No patch listed yet
What would change the score
- Would score about 69 if added to CISA KEV
- Would score about 64 if CISA's SSVC rates exploitation active
- Would score about 36 if advisories confirm default setups are exposed
What to do
Workaround: The checked facts list no workaround. The exposure depends on the WebDriver server being reachable across all network interfaces on TCP port 4444, so limiting that reachability is the only mitigation the facts point to, and no source confirms it.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- Hisense VIDAA
0000.01.00a.P0220
Evidence 2
- Exploit
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-123993
Is CVE-2026-123993 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
The WebDriver automation server accepts connections without authentication, so a network attacker could run JavaScript on the TV. From there, the attacker could read and send out localStorage data such as telemetry, MAC addresses, ad-service credentials, and location data, and could push persistent content onto the display. The attacker could also reach the window.hisense native bridge for filesystem and system-state operations.Source: vulncheck.com
Which versions are affected by CVE-2026-123993?
VIDAA: version 0000.01.00a.P0220.Source: cve.now feed data
Am I affected, and how do I check?
The vulnerability is listed for Hisense VIDAA firmware V0000.01.00a.P0220 and earlier. The exposure also requires a QA build of the Google Cobalt browser engine that listens for WebDriver on TCP port 4444 across all network interfaces. Compare your TV's firmware version with that value to see where it falls.Source: vulncheck.com
How do I fix CVE-2026-123993?
The checked facts do not name a fixed firmware version, so no upgrade target is available from the sources. Check the vendor's channels for a later firmware release.Source: vulncheck.com
What if there's no patch?
The checked facts list no workaround. The exposure depends on the WebDriver server being reachable across all network interfaces on TCP port 4444, so limiting that reachability is the only mitigation the facts point to, and no source confirms it.Source: vulncheck.com