CVE-2025-55971
📋 TL;DR
This CVE describes a blind Server-Side Request Forgery (SSRF) vulnerability in TCL 65C655 Smart TVs that allows unauthenticated attackers to make the TV send HTTP requests to arbitrary internal or external targets. Attackers can use this to probe for other vulnerable services accessible from the TV's network position. All users of the affected TCL Smart TV model with vulnerable firmware are at risk.
💻 Affected Systems
- TCL 65C655 Smart TV
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could chain this SSRF with other vulnerabilities to achieve remote code execution, access internal network services, or perform reconnaissance for further attacks.
Likely Case
Attackers will use the TV to scan internal networks for other vulnerable devices or services, potentially discovering additional attack vectors.
If Mitigated
With proper network segmentation and firewall rules, the impact is limited to the TV itself making outbound requests without exposing additional attack surfaces.
🎯 Exploit Status
Exploitation requires sending crafted SOAP requests to TCP port 16398. Public proof-of-concept code and demonstration videos are available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None known
Restart Required: No
Instructions:
Check for firmware updates through the TV's settings menu under System > About > System update. If no patch is available, apply workarounds.
🔧 Temporary Workarounds
Block UPnP Service Port
linuxBlock incoming connections to TCP port 16398 on the TV using network firewall rules.
iptables -A INPUT -p tcp --dport 16398 -j DROP
Disable UPnP/DLNA Services
allTurn off UPnP and DLNA services in the TV settings if not needed.
🧯 If You Can't Patch
- Segment the TV on a separate VLAN or network segment to limit its access to other devices.
- Implement egress filtering to restrict the TV's outbound connections to only necessary destinations.
🔍 How to Verify
Check if Vulnerable:
Send a crafted SetAVTransportURI SOAP request to the TV's IP on port 16398 and monitor for outbound requests to a controlled server.Check Version:
Check TV settings: System > About > Build numberVerify Fix Applied:
Test if the TV still processes SetAVTransportURI requests after applying firewall rules or disabling services.📡 Detection & Monitoring
Log Indicators:
- Unusual outbound HTTP requests from TV to internal or external IPs
- Failed connection attempts from TV to unusual ports
Network Indicators:
- TCP connections from TV to port 16398
- SOAP requests with SetAVTransportURI action to TV
SIEM Query:
source_ip="TV_IP" AND (dest_port=16398 OR (http_user_agent LIKE "%UPnP%" AND dest_port IN [80,443,8080]))