Hisense VIDAA Smart TV Unauthenticated DoS via SetAVTransportURI

Summary

Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an unauthenticated denial-of-service vulnerability in the UPnP/DLNA AVTransport SOAP service that allows LAN-adjacent attackers to freeze the entire television software layer by sending a crafted SetAVTransportURI request on TCP port 38400. Attackers can exploit this flaw without credentials to render the device completely unresponsive to remote control or front-panel input, requiring a physical power cycle to restore functionality.

Remediation

1. Inventory every Hisense VIDAA deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Advisoryhttps://www.vulncheck.com/advisories/hisense-vidaa-smart-tv-unauthenticated-dos-via-setavtransporturi
• Referencehttps://github.com/yehia-mamdouh/Hisense-Smart-TV-Security-Research