Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains a flaw in the DIAL (Discovery and Launch) service listening on TCP 56789 that accepts requests without any authentication, pairing or user notification. Attackers can query which applications are running, enumerate installed apps via HTTP status codes, terminate active sessions with DELETE requests, launch new applications, or spoof the Origin header to bypass YouTube checks. These actions allow disclosure of viewing activity, subscriptions, and can disrupt normal device operation.

The vulnerability affects Hisense VIDAA Smart TV devices running firmware V0000.01.00a.P0220. Devices without the updated firmware are susceptible to unauthenticated access from any LAN‑adjacent machine.

The CVSS score is 5.3, indicating a moderate severity. The EPSS score is not available and the issue is not listed in CISA’s KEV catalog. Because the service is exposed to any device on the local network and requires no authentication, the attack vector is local network access and the likelihood of exploitation in a compromised LAN is significant. While the vulnerability does not provide remote code execution, it permits information disclosure, device control, and potential disruption of user experience.