A LAN‑adjacent attacker can issue SetVolume, SetMute and SelectPreset(FactoryDefaults) commands without authentication via the UPnP/DLNA RenderingControl service on TCP port 38400. Because the service lacks per‑command authentication or a session token, an attacker may repeatedly send these commands to override remote input, change volume and mute, and reset all picture and audio calibration settings, providing full control over the TV’s audio and picture outputs.

This vulnerability affects Hisense VIDAA Smart TV firmware V0000.01.00a.P0220.

The CVSS score of 4.8 categorizes the flaw as moderate, and because no EPSS data is available and it is not listed in the CISA KEV catalog, the likelihood of exploitation is uncertain. The missing authentication enables a local network attacker to perform direct command injection on TCP port 38400. If the attacker can reach the TV over the LAN, they could take control of its volume, mute, and preset settings, potentially disrupting user experience or exposing content. A sufficient attack requires proximity to the same local network and the ability to send DLNA requests, but does not require external internet access.