Hisense VIDAA 0000.01.00a.P0220 Remote-Control MQTT Broker improper authentication

Summaryinfo

A vulnerability labeled as very critical has been found in Hisense VIDAA 0000.01.00a.P0220. Affected by this issue is some unknown functionality of the component Remote-Control MQTT Broker. Such manipulation leads to improper authentication. This vulnerability is uniquely identified as CVE-2026-123998. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability, which was classified as very critical, has been found in Hisense VIDAA 0000.01.00a.P0220. Affected by this issue is an unknown part of the component Remote-Control MQTT Broker. The manipulation with an unknown input leads to a improper authentication vulnerability. Using CWE to declare the problem leads to CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an authentication bypass vulnerability in its remote-control MQTT broker on TCP port 36669, which accepts publicly documented default credentials and an ineffective 4-digit pairing PIN with no rate limiting or lockout, allowing a brute force of the entire code space in about five seconds, while some actions require no pairing at all. A LAN-adjacent attacker can exploit this to inject key events, change volume, switch input sources, enumerate inputs, launch arbitrary installed applications, and monitor pairing activity, posing a significant risk in hotel deployments where untrusted LAN access is common.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-123998 since 11/06/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 11/06/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Hisense

Name

• VIDAA

Version

• 0000.01.00a.P0220

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion