CVE-2025-55971: tcl 65c655_firmware Server-Side Request Forgery

Vulnerability summary

CVE-2025-55971 is a medium (CVSS 4.7) Server-Side Request Forgery vulnerability in tcl 65c655_firmware. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 23.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 03-10-2025
   PublishedVulnerability first disclosed.
2. 03-10-2025
   Last modifiedVulnerability information updated.

Description

TCL 65C655 Smart TV, running firmware version V8-R75PT01-LF1V269.001116 (Android TV, Kernel 5.4.242+), is vulnerable to a blind, unauthenticated Server-Side Request Forgery (SSRF) vulnerability via the UPnP MediaRenderer service (AVTransport:1). The device accepts unauthenticated SetAVTransportURI SOAP requests over TCP/16398 and attempts to retrieve externally referenced URIs, including attacker-controlled payloads. The blind SSRF allows for sending requests on behalf of the TV, which can be leveraged to probe for other internal or external services accessible by the device (e.g., 127.0.0.1:16XXX, LAN services, or internet targets), potentially enabling additional exploit chains.

• CWE-918Server-Side Request ForgeryThe web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.