TCL Smart TV UPnP/DLNA Remote Denial-of-Service Vulnerability

A remote, unauthenticated denial-of-service vulnerability has been identified in a TCL Smart TV model 65C655, due to a flawed UPnP/DLNA MediaRenderer implementation. The issue arises when an attacker sends a large volume of malformed or oversized SetAVTransportURI SOAP requests to the UPnP control endpoint. This flood of requests causes the TV to become unresponsive, disrupting all functions. Manual controls and reboots do not restore normal operation until the attack ceases.

Impact

Exploitation of this vulnerability leads to the TV becoming unresponsive, with the denial of service persisting as long as the attack continues. This unresponsiveness affects all TV operations, and manual reboots do not restore functionality until the attack stops.