PT-2025-40532 · Tcl · Tcl Smart Tv

Szym0N13K · Published 2025-10-03 · Updated 2025-10-16 · CVE-2025-55972

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions TCL Smart TV (affected versions not specified)

Description A TCL Smart TV with a vulnerable UPnP/DLNA MediaRenderer implementation is subject to a remote, unauthenticated Denial of Service (DoS) condition. An attacker can send a flood of malformed or oversized SetAVTransportURI SOAP requests to the UPnP control endpoint, causing the device to become unresponsive. This denial of service persists while the attack continues and impacts all TV operations. Standard user controls and reboots do not restore functionality unless the attack ceases. The API endpoint affected is the UPnP control endpoint. The vulnerable request type is SetAVTransportURI.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2025-55972

Affected Products

Tcl Smart Tv

References · 5

• 🔥 https://youtube.com/watch?v=CRik5mp4SW4 · Exploit
• 🔥 https://github.com/Szym0n13k/CVE-2025-55972-Remote-Unauthenticated-Denial-of-Service-DoS-in-TCL-Smart-TV-UPnP-DLNA-AVTransport · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-55972 · Security Note
• https://t.me/cveNotify/138935 · Telegram Post
• https://twitter.com/cracbot/status/1975878909645254706 · Twitter Post