Hisense VIDAA Smart TV MQTT Broker Authentication Bypass
Affects Hisense VIDAA Smart TVs on firmware V0000.01.00a.P0220 or earlier, through the remote-control MQTT broker on TCP port 36669. No vendor rating or fix is listed in the checked facts.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- No fix listed
- Who is exposed
- Not reported
Do first: Workaround: The checked facts contain no workaround or vendor guidance for this issue, so no mitigation can be confirmed from them.
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 12/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Hisense VIDAA smart TVs have an authentication bypass in their remote-control MQTT broker, which an attacker on the same local network can reach without logging in or any user action. The attacker can then send key presses, change volume and inputs, launch installed apps, and monitor pairing activity, since the broker accepts default credentials and a weak 4-digit PIN with no lockout.
Read the original description
Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an authentication bypass vulnerability in its remote-control MQTT broker on TCP port 36669, which accepts publicly documented default credentials and an ineffective 4-digit pairing PIN with no rate limiting or lockout, allowing a brute force of the entire code space in about five seconds, while some actions require no pairing at all. A LAN-adjacent attacker can exploit this to inject key events, change volume, switch input sources, enumerate inputs, launch arbitrary installed applications, and monitor pairing activity, posing a significant risk in hotel deployments where untrusted LAN access is common.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure?/25Unknown. Advisories don't say whether default setups are affected
- Reach?/20Unknown. No tracked technology or package matched
- Severity7.2/10CVSS 7.2
- No patch5/5No patch listed yet
What would change the score
- Would score about 67 if added to CISA KEV
- Would score about 62 if CISA's SSVC rates exploitation active
- Would score about 34 if advisories confirm default setups are exposed
What to do
Workaround: The checked facts contain no workaround or vendor guidance for this issue, so no mitigation can be confirmed from them.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- Hisense VIDAA
0000.01.00a.P0220
Evidence 2
- Exploit
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-123998
Is CVE-2026-123998 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
The TV's remote-control MQTT broker on TCP port 36669 lacks proper authentication, so it can be bypassed. The checked facts say this allows injecting key events, changing volume, switching input sources, listing inputs, launching installed applications, and monitoring pairing activity.Source: vulncheck.com
Which versions are affected by CVE-2026-123998?
VIDAA: version 0000.01.00a.P0220.Source: cve.now feed data
Am I affected, and how do I check?
Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 or earlier is affected, specifically the remote-control MQTT broker on TCP port 36669. To check, compare the TV's firmware version against V0000.01.00a.P0220.Source: vulncheck.com
How do I fix CVE-2026-123998?
The checked facts do not list a fixed firmware version, so no upgrade target can be given.Source: vulncheck.com
What if there's no patch?
The checked facts contain no workaround or vendor guidance for this issue, so no mitigation can be confirmed from them.Source: vulncheck.com