What is GHSA-6pfw-v7rf-jx64?

GHSA-6pfw-v7rf-jx64 is a security advisory published by GitHub Security Advisories with High severity. Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an unauthenticated denial-of-service...

Which CVE IDs does GHSA-6pfw-v7rf-jx64 cover?

GHSA-6pfw-v7rf-jx64 covers the following CVE IDs: CVE-2026-123997. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-6pfw-v7rf-jx64?

GHSA-6pfw-v7rf-jx64 has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

GHSA-6pfw-v7rf-jx64HighCVSS 6.5

Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an unauthenticated denial-of-service...

Vendor

GitHub Security Advisories

Published

November 6, 2026

Last Modified

November 6, 2026

🔗 CVE IDs covered (1)

CVE-2026-123997 →

📋 Description

Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an unauthenticated denial-of-service vulnerability in the UPnP/DLNA AVTransport SOAP service that allows LAN-adjacent attackers to freeze the entire television software layer by sending a crafted SetAVTransportURI request on TCP port 38400. Attackers can exploit this flaw without credentials to render the device completely unresponsive to remote control or front-panel input, requiring a physical power cycle to restore functionality.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-123997
https://github.com/yehia-mamdouh/Hisense-Smart-TV-Security-Research
https://www.vulncheck.com/advisories/hisense-vidaa-smart-tv-unauthenticated-dos-via-setavtransporturi
https://github.com/advisories/GHSA-6pfw-v7rf-jx64