{"id":"CVE-2026-123998","published":"2026-11-06T19:17:45.427","lastModified":"2026-11-09T14:17:14.197","description":"Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an authentication bypass vulnerability in its remote-control MQTT broker on TCP port 36669, which accepts publicly documented default credentials and an ineffective 4-digit pairing PIN with no rate limiting or lockout, allowing a brute force of the entire code space in about five seconds, while some actions require no pairing at all. A LAN-adjacent attacker can exploit this to inject key events, change volume, switch input sources, enumerate inputs, launch arbitrary installed applications, and monitor pairing activity, posing a significant risk in hotel deployments where untrusted LAN access is common.","cvssScore":8.3,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","cwes":["CWE-307","CWE-1392"],"vendors":[],"products":[],"references":[{"url":"https://github.com/yehia-mamdouh/Hisense-Smart-TV-Security-Research","tags":[]},{"url":"https://www.vulncheck.com/advisories/hisense-vidaa-smart-tv-mqtt-broker-authentication-bypass","tags":[]}],"exploitRefs":[{"url":"https://github.com/yehia-mamdouh/Hisense-Smart-TV-Security-Research","tags":[]}],"hasPoc":true,"ai":{"summary":"The Hisense VIDAA Smart TV firmware contains an authentication bypass in its MQTT broker on port 36669, where default credentials and a weak 4-digit PIN (brute-forced in ~5 seconds) allow unauthenticated remote control access, with some actions requiring no pairing at all. This enables LAN-adjacent attackers to inject keypresses, change volume, switch inputs, launch apps, and monitor pairing activity.","exploitability":"Exploitation is trivial for an attacker on the same LAN segment due to publicly documented default credentials, no rate limiting, and a tiny 10,000-entry PIN space brute-forced in seconds.","blast_radius":"In hotel or shared-network deployments where untrusted devices share the LAN, attackers can fully compromise TV functionality, enabling surveillance, user disruption, or lateral movement via compromised TVs.","remediation":"Upgrade to firmware version V0000.01.01a.P0220 or later (if available); if no fixed version is published, disable the MQTT broker on port 36669 and restrict network access to the TV's management interface via VLAN segmentation.","detection":"Look for repeated rapid TCP connections to port 36669 from multiple source IPs on the LAN, or repeated MQTT CONNECT attempts with invalid credentials followed by successful authentication within seconds—indicative of PIN brute-force activity. No reliable host-side logs are guaranteed; network-based detection is primary.","tags":["auth-bypass","iot","mqtt","brute-force","hotel-risk","remote-control"],"model":"garnet-coder","analyzedAt":"2026-11-10T09:55:36.375Z"}}