szym0n13k/cve-2025-55972-remote-unauthenticated-denial-of-service-dos-in-tcl-smart-tv-upnp-dlna-avtransportA TCL Smart TV running a vulnerable UPnP/DLNA MediaRenderer implementation is affected by a remote, unauthenticated Denial of Service (DoS).
A TCL Smart TV running a vulnerable UPnP/DLNA MediaRenderer implementation is affected by a remote, unauthenticated Denial of Service (DoS).
TCL Technology Group Corporation
TCL Smart TV (tested: 65C655)
Remote Denial of Service (DoS) in UPnP/DLNA MediaRenderer (AVTransport)
Device become unresponsive or unavailable while the attack persists.
6.5 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
2025-06-28
CVE-2025-55972
A TCL Smart TV running a vulnerable UPnP/DLNA MediaRenderer implementation is affected by a remote, unauthenticated Denial of Service (DoS). By sending a flood of malformed or oversized SetAVTransportURI SOAP requests to the UPnP control endpoint, an attacker on the local network (or via a forwarded port) can cause the device to become unresponsive. The denial persists while the flood continues and can affect all TV operations; manual control and reboots do not restore functionality until the attack stops.
