PT-2020-16684 · Tcl · Tcl Android Smart Tv

Johnjhacking + 1 · Published 2020-11-10 · Updated 2026-02-19 · CVE-2020-27403

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions TCL Android Smart TV series V8-R851T02-LF1 versions V295 and below TCL Android Smart TV series V8-T658T01-LF1 versions V373 and below

Description A vulnerability in the TCL Android Smart TV series allows an attacker on the adjacent network to arbitrarily browse and download sensitive files over an insecure web server running on port 7989 that lists all files & directories. An unprivileged remote attacker on the adjacent network can download most system files, leading to serious critical information disclosure. Some TV models and/or firmware versions may expose the web server with the entire file system accessible on another port.

Recommendations For TCL Android Smart TV series V8-R851T02-LF1 versions V295 and below: As a temporary workaround, consider disabling access to the insecure web server running on port 7989 until a patch is available. For TCL Android Smart TV series V8-T658T01-LF1 versions V373 and below: Restrict access to the web server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2020-27403

Affected Products

Tcl Android Smart Tv

References · 17

• 🔥 https://github.com/sickcodes/security/blob/master/advisories/SICK-2020-009.md · Exploit
• 🔥 https://github.com/sickcodes/security/blob/master/etc/CVE-2020-27403_CVE-2020-28055_GlobalFAQ.pdf · Exploit
• 🔥 https://github.com/sickcodes/security/blob/master/etc/CVE-2020-27403_CVE-2020-28055_Press-Statement-and-Questions_11162020.pdf · Exploit
• 🔥 https://sick.codes/sick-2020-009 · Exploit
• 🔥 https://sick.codes/extraordinary-vulnerabilities-discovered-in-tcl-android-tvs-now-worlds-3rd-largest-tv-manufacturer · Exploit
• https://osv.dev/vulnerability/CVE-2020-27403 · Vendor Advisory
• https://support.tcl.com/vulnerabilities-found-in-tcl-android-tvs · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-27403 · Security Note
• https://github.com/sickcodes/security/issues/1 · Note
• https://t.me/cibsecurity/16115 · Telegram Post
• https://twitter.com/grok/status/2024324237394141308 · Twitter Post
• https://securityledger.com/2020/11/tv-maker-tcl-denies-back-door-promises-better-process · Note
• https://t.me/cvenotify/6336 · Telegram Post
• https://securityledger.com/2020/11/security-holes-opened-back-door-to-tcl-android-smart-tvs · Note
• https://github.com/sickcodes · Note