An input validation flaw in the UPnP/DLNA AVTransport SOAP service lets a device on the same local network call SetAVTransportURI with an arbitrary CurrentURI value. The service accepts any URI scheme, host or path, which allows the TV to download and render malicious content such as phishing pages, counterfeit firmware update prompts, or fake emergency alerts. This can be executed after a one‑time DLNA pairing and can silently trigger subsequent commands.

Hisense VIDAA Smart TVs running firmware V0000.01.00a.P0220 are affected, as they do not validate the CurrentURI input before requesting the resource.

The severity score of 4.8 indicates a moderate risk. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Attackers need local network proximity to the TV to exploit the flaw, but once in, they can cause the TV to display malicious content to users, potentially leading to credential capture or other social‑engineering attacks.