
TCL 65C655 Smart TV, running firmware version V8-R75PT01-LF1V269.001116 (Android TV, Kernel 5.4.242+), is vulnerable to a blind, unauthenticated Server-Side Request Forgery (SSRF) via the UPnP MediaRenderer service (AVTransport).
TCL 65C655 Smart TV, running firmware version V8-R75PT01-LF1V269.001116 (Android TV, Kernel 5.4.242+), is vulnerable to a blind, unauthenticated Server-Side Request Forgery (SSRF) via the UPnP MediaRenderer service (AVTransport).
TCL Technology Group Corporation
TCL Smart TV (tested: 65C655)
Unauthenticated blind Server-Side Request Forgery (SSRF) in UPnP/DLNA MediaRenderer (AVTransport)
Device may issue outbound HTTP requests to attacker-controlled destinations on the local network or the Internet (blind SSRF).
4.6 (AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L)
2025-06-28
CVE-2025-55971
TCL 65C655 Smart TV, running firmware version V8-R75PT01-LF1V269.001116 (Android TV, Kernel 5.4.242+), is vulnerable to a blind, unauthenticated Server-Side Request Forgery (SSRF) via the UPnP MediaRenderer service (AVTransport:1). The device accepts unauthenticated SetAVTransportURI SOAP requests over TCP/16XXX and attempts to retrieve externally referenced URIs, including attacker-controlled payloads. The blind SSRF allows an attacker to force the TV to send requests on its behalf to internal (e.g., 127.0.0.1:16XXX, LAN services) or internet targets, which may be leveraged in further exploit chains. Supported URIs include .jpg, .png, .mp3, .mp4, .gif, and other standard media formats. Affected port changes across restarts but remains within the 16XXX range.