CVE-2026-123997: VIDAA UPnP SOAP flaw

CISO Take

Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 has an unauthenticated flaw in its UPnP/DLNA AVTransport service: a crafted SetAVTransportURI request to TCP port 38400 freezes the TV's software layer until someone physically power-cycles it. This is a consumer IoT device rather than an AI/ML system, so the AI relevance is marginal (the 'ml_ui' tag looks like a classification artifact) and it poses little direct risk to AI pipelines or model assets. The CVSS is 6.5 (medium), and the attacker must be on the same LAN segment. There is no EPSS data, no CISA KEV listing, and no SSVC decision. A public proof-of-concept repository is referenced, so exploitation is trivial for anyone on the network. Keep these TVs off corporate or sensitive VLANs, block UPnP/DLNA traffic on port 38400 at the network layer, and apply a vendor firmware update once one is released. No patched version is currently identified.

Sources:NVDVulnCheckATLAS

What is the risk?

Low-to-medium overall risk. The attack needs adjacent network access, but it is low complexity and needs no privileges or user interaction. Impact is limited to availability (A:H) with no confidentiality or integrity loss. A public PoC reference exists, but there is no KEV listing, no Nuclei template, and no EPSS score. For AI/ML environments the exposure is minimal unless these TVs sit on the same network segment as AI workloads, for example as dashboards in a SOC or lab. In that case the impact is a nuisance outage, not a compromise of AI systems.

How does the attack unfold?

Initial Access

Attacker gains adjacent network access (LAN or Wi-Fi) and discovers the TV on TCP port 38400.

AML.T0006

Exploitation

Attacker sends a crafted unauthenticated SetAVTransportURI SOAP request to the AVTransport service.

Impact

The TV software layer freezes and ignores all input until a physical power cycle restores it.

AML.T0029

Initial Access

Attacker gains adjacent network access (LAN or Wi-Fi) and discovers the TV on TCP port 38400.

AML.T0006

Exploitation

Attacker sends a crafted unauthenticated SetAVTransportURI SOAP request to the AVTransport service.

Impact

The TV software layer freezes and ignores all input until a physical power cycle restores it.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
VIDAA	—	—	No patch

Do you use VIDAA? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVAdjacent

ACLow

PRNone

UINone

SUnchanged

CNone

INone

AHigh

What should I do?

1 step

1) Check Hisense/VIDAA for a firmware update beyond V0000.01.00a.P0220 and apply it when available. 2) Place smart TVs and other IoT devices on isolated VLANs with no route to corporate or AI infrastructure. 3) Block or restrict inbound TCP 38400 and UPnP/DLNA (SSDP/1900) traffic between client segments. 4) Disable DLNA/UPnP media renderer features in the TV settings if the option is available. 5) Monitor for anomalous SOAP requests (SetAVTransportURI) to port 38400 and for devices that suddenly go unresponsive. 6) Inventory TVs used in operations centers or meeting rooms.

How is it classified?

DoSAPIAML.T0029- Denial of AI Service

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Response to unknown risks and deactivation of AI systems

Frequently Asked Questions

What is CVE-2026-123997?

Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 has an unauthenticated flaw in its UPnP/DLNA AVTransport service: a crafted SetAVTransportURI request to TCP port 38400 freezes the TV's software layer until someone physically power-cycles it. This is a consumer IoT device rather than an AI/ML system, so the AI relevance is marginal (the 'ml_ui' tag looks like a classification artifact) and it poses little direct risk to AI pipelines or model assets. The CVSS is 6.5 (medium), and the attacker must be on the same LAN segment. There is no EPSS data, no CISA KEV listing, and no SSVC decision. A public proof-of-concept repository is referenced, so exploitation is trivial for anyone on the network. Keep these TVs off corporate or sensitive VLANs, block UPnP/DLNA traffic on port 38400 at the network layer, and apply a vendor firmware update once one is released. No patched version is currently identified.

Is CVE-2026-123997 actively exploited?

No confirmed active exploitation of CVE-2026-123997 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-123997?

1) Check Hisense/VIDAA for a firmware update beyond V0000.01.00a.P0220 and apply it when available. 2) Place smart TVs and other IoT devices on isolated VLANs with no route to corporate or AI infrastructure. 3) Block or restrict inbound TCP 38400 and UPnP/DLNA (SSDP/1900) traffic between client segments. 4) Disable DLNA/UPnP media renderer features in the TV settings if the option is available. 5) Monitor for anomalous SOAP requests (SetAVTransportURI) to port 38400 and for devices that suddenly go unresponsive. 6) Inventory TVs used in operations centers or meeting rooms.

What systems are affected by CVE-2026-123997?

This vulnerability affects the following AI/ML architecture patterns: IoT display endpoints, Operations center dashboards.

What is the CVSS score for CVE-2026-123997?

CVE-2026-123997 has a CVSS v3.1 base score of 6.5 (MEDIUM).

What is the AI security impact?

Affected AI Architectures

IoT display endpointsOperations center dashboards

MITRE ATLAS Techniques

AML.T0029Denial of AI Service

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an unauthenticated denial-of-service vulnerability in the UPnP/DLNA AVTransport SOAP service that allows LAN-adjacent attackers to freeze the entire television software layer by sending a crafted SetAVTransportURI request on TCP port 38400. Attackers can exploit this flaw without credentials to render the device completely unresponsive to remote control or front-panel input, requiring a physical power cycle to restore functionality.

Exploitation Scenario

An attacker with access to the same Wi-Fi or LAN, for example a guest network that is not isolated, discovers the TV through SSDP or a scan of port 38400. They send a crafted SetAVTransportURI SOAP request that exhausts resources (CWE-770, allocation without limits). The TV software layer freezes and ignores remote and front-panel input. Staff must physically unplug the TV. In an AI context, this could knock out a wall display showing model monitoring or SOC dashboards during an incident, with no effect on the AI systems themselves.

Weaknesses (CWE)

CWE-770Allocation of Resources Without Limits or Throttling

CWE-770 — Allocation of Resources Without Limits or Throttling: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

[Requirements] Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
[Architecture and Design] Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.

Source: MITRE CWE corpus.