CVE-2026-15570

HIGH

CVE: CVE-2026-15570 - An improper restriction of URL schemes and destinations in the SmartCenter browserseturl command in the Telefunken TE24553B45V2DZ Smart T...Sign in to save

CVSS

7.1

CVSS v4.0

EPSS

0.2%

Exploit Prediction Score

Published

August 7, 2026

Exploitability

EPSS probability 0.2%

Description

An improper restriction of URL schemes and destinations in the SmartCenter browserseturl command in the Telefunken TE24553B45V2DZ Smart TV running on the Vestel MB181 / Voltron181 / TiVo OS platform allows an attacker with access to the same local network to cause the embedded browser to issue requests to unintended loopback/internal destinations, including 127.0.0.1 addresses. In demonstrated scenarios, requests initiated through the SmartCenter browserseturl mechanism could reach an internal service and receive a successful response, although the same destination was not reachable through normal browser navigation. The issue affects firmware version V2.78.0.0 and is fixed in firmware version V2.85.2.0.

Weaknesses

CWE-918

Affected Packages

No package data available.

Aliases

CVE-2026-15570

Related references

Publisher and database URLs for this record (shown for attribution; reading stays in Bugflare).

https://firebasestorage.googleapis.com/v0/b/vestel-shield.firebasestorage.app/o/PRODUCTION%2F4%2FVSA-4.pdf?alt=media&tok…
https://vestelinternational.com/security-advisories