Threats affecting pkg:github/hisense/VIDAA

Hisense VIDAA Smart TV firmware version 0000.01.00a.P0220 has an authentication bypass vulnerability in its remote-control MQTT broker on TCP port 36669. The broker accepts default credentials and uses a weak 4-digit pairing PIN without rate limiting or lockout, enabling brute force attacks in about five seconds. Some actions require no pairing, allowing a LAN-adjacent attacker to inject key events, change volume, switch inputs, enumerate inputs, launch apps, and monitor pairing activity. This poses a significant risk especially in hotel environments with untrusted LAN access.

Hisense VIDAA Smart TV firmware version 0000.01.00a.P0220 has a missing authentication vulnerability in its UPnP/DLNA RenderingControl service on TCP port 38400. This flaw allows a LAN-adjacent attacker, after a one-time DLNA pairing, to send unauthenticated commands such as SetVolume, SetMute, and SelectPreset(FactoryDefaults). The attacker can continuously issue these commands without per-command authentication or session tokens, enabling control over volume, mute functions, and resetting picture and audio calibration settings.