CVE-2026-123998

Summary

The Hisense VIDAA Smart TV firmware contains an authentication bypass in its MQTT broker on port 36669, where default credentials and a weak 4-digit PIN (brute-forced in ~5 seconds) allow unauthenticated remote control access, with some actions requiring no pairing at all. This enables LAN-adjacent attackers to inject keypresses, change volume, switch inputs, launch apps, and monitor pairing activity.

Exploitability

Exploitation is trivial for an attacker on the same LAN segment due to publicly documented default credentials, no rate limiting, and a tiny 10,000-entry PIN space brute-forced in seconds.

Blast radius

In hotel or shared-network deployments where untrusted devices share the LAN, attackers can fully compromise TV functionality, enabling surveillance, user disruption, or lateral movement via compromised TVs.

Detection

Look for repeated rapid TCP connections to port 36669 from multiple source IPs on the LAN, or repeated MQTT CONNECT attempts with invalid credentials followed by successful authentication within seconds—indicative of PIN brute-force activity. No reliable host-side logs are guaranteed; network-based detection is primary.

Prioritized remediation

Upgrade to firmware version V0000.01.01a.P0220 or later (if available); if no fixed version is published, disable the MQTT broker on port 36669 and restrict network access to the TV's management interface via VLAN segmentation.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.