A TCL Smart TV running a vulnerable UPnP/DLNA MediaRenderer implementation is affected by a remote, unauthenticated Denial of Service (DoS) condition. By sending a flood of malformed or oversized SetAVTransportURI SOAP requests to the UPnP control endpoint, an attacker can cause the device to become unresponsive. This denial persists as long as the attack continues and affects all forms of TV operation. Manual user control and even reboots do not restore functionality unless the flood stops.
References
| Link | Resource |
|---|---|
| https://github.com/Szym0n13k/CVE-2025-55972-Remote-Unauthenticated-Denial-of-Service-DoS-in-TCL-Smart-TV-UPnP-DLNA-AVTransport | Third Party Advisory |
| https://www.youtube.com/watch?v=CRik5mp4SW4 | Exploit |
Configurations
Configuration 1 (hide)
| AND |
|
History
16 Oct 2025, 13:12
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/Szym0n13k/CVE-2025-55972-Remote-Unauthenticated-Denial-of-Service-DoS-in-TCL-Smart-TV-UPnP-DLNA-AVTransport - Third Party Advisory | |
| References | () https://www.youtube.com/watch?v=CRik5mp4SW4 - Exploit | |
| CPE | cpe:2.3:o:tcl:65c655_firmware:-:*:*:*:*:*:*:* cpe:2.3:h:tcl:65c655:-:*:*:*:*:*:*:* |
|
| First Time |
Tcl 65c655 Firmware
Tcl Tcl 65c655 |
03 Oct 2025, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| CWE | CWE-400 |
03 Oct 2025, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-10-03 16:16
Updated : 2025-10-16 13:12
NVD link : CVE-2025-55972
Mitre link : CVE-2025-55972
CVE.ORG link : CVE-2025-55972
JSON object : View
Products Affected
tcl
- 65c655
- 65c655_firmware
CWE
CWE-400
Uncontrolled Resource Consumption