Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an unauthenticated WebDriver automation server listening on TCP port 4444 across all network interfaces. An attacker on the same LAN can connect to the service without credentials and execute arbitrary JavaScript, read and exfiltrate localStorage data, inject persistent content into the user interface, and use the native bridge to read or write files and perform system-state operations. This constitutes remote code execution and data exfiltration, making it possible to steal telemetry, MAC addresses, ad‑service credentials, and location data.

Affected systems include Hisense VIDAA Smart TVs that ship with firmware version V0000.01.00a.P0220. The vulnerability is present in QA builds that expose the WebDriver engine, so any TV running that exact firmware revision is susceptible. Other firmware revisions not containing the exposed WebDriver are not affected.

The CVSS score of 8.7 indicates high severity and the lack of an authentication requirement increases the attack surface. EPSS is not available, but the attack vector is inferred to be local network due to the open TCP port. Because the vulnerability is not listed in CISA KEV, no specific exploitation campaigns are currently known, yet the simplicity of the exploit suggests a high likelihood of future exploitation. An attacker that can reach the TV on the LAN can immediately achieve full control and exfiltrate sensitive data.