Threats tagged 'ghsa-8qh4-38v4-7w3v'

Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 has a missing authentication vulnerability in its UPnP/DLNA RenderingControl service on TCP port 38400. This flaw allows a LAN-adjacent attacker to issue commands such as SetVolume, SetMute, and SelectPreset (FactoryDefaults) after a one-time DLNA pairing without requiring per-command authentication or session tokens. Attackers can continuously send unauthenticated commands to override the physical remote control, adjust volume and mute settings, and reset picture and audio calibration.