Which versions of Telefunken Smart TV are affected by EUVD-2026-54481?

Telefunken TE24553B45V2DZ Smart TV firmware V2.78.0.0 contains a Server-Side Request Forgery vulnerability in the SmartCenter component that allows network-adjacent attackers to redirect the device's…

How to fix or mitigate EUVD-2026-54481?

Within 24 hours, identify and inventory all Telefunken TE24553B45V2DZ devices running firmware V2.78.0.0, prioritizing hospitality and guest-accessible deployments. Within 7 days, implement network segmentation to isolate affected devices from guest networks, disable SmartCenter browser functionality where operationally feasible, and restrict administrative access to administration-only network segments. Within 30 days, establish a patch monitoring process with the vendor, evaluate replacement with patched firmware versions as they become available, and conduct internal service audits to identify any systems that could be reached through device compromise.

Telefunken Smart TV EUVD-2026-54481

Q: What is the CVSS score of EUVD-2026-54481?

EUVD-2026-54481 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-15570 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-08-07 Vestel

GHSA-7535-6xrw-p7v8

SSRF Telefunken Te24553B45V2Dz Smart Tv

7.1

CVSS 4.0 · Vendor: Vestel

Severity by source

Vendor (Vestel) PRIMARY

7.1 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.6 HIGH

Adjacent network access only; SSRF enables internal service interaction (I:H) and limited response disclosure (C:L); no scope change per vendor assessment.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Vestel).

CVSS VectorVendor: Vestel

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 14:17 vuln.today

CVE Published

Aug 07, 2026 - 13:32 cve.org

HIGH 7.1

DescriptionCVE.org

An improper restriction of URL schemes and destinations in the SmartCenter browserseturl command in the Telefunken TE24553B45V2DZ Smart TV running on the Vestel MB181 / Voltron181 / TiVo OS platform allows an attacker with access to the same local network to cause the embedded browser to issue requests to unintended loopback/internal destinations, including 127.0.0.1 addresses. In demonstrated scenarios, requests initiated through the SmartCenter browserseturl mechanism could reach an internal service and receive a successful response, although the same destination was not reachable through normal browser navigation. The issue affects firmware version V2.78.0.0 and is fixed in firmware version V2.85.2.0.

AnalysisAI

Server-Side Request Forgery in the Telefunken TE24553B45V2DZ Smart TV firmware V2.78.0.0 allows a network-adjacent unauthenticated attacker to abuse the SmartCenter browserseturl command, redirecting the device's embedded browser to loopback (127.0.0.1) and internal network destinations that are otherwise unreachable through normal browser navigation. The Vestel MB181 / Voltron181 / TiVo OS platform's SmartCenter component fails to restrict target URL schemes and destinations, enabling the TV to serve as an internal SSRF proxy against its own locally-running services. No public exploit code has been identified and this CVE is absent from the CISA KEV catalog; however, the zero-privilege, adjacent-network attack posture makes exploitation accessible to any local network attacker, including guests in hospitality deployments.

Technical ContextAI

CWE-918 (Server-Side Request Forgery) describes a class of flaw where an application fetches remote resources on behalf of a user-supplied input without adequately restricting target URLs. Here, the SmartCenter service - a Smart TV remote-control and automation component - exposes a browserseturl command that instructs the Vestel-platform embedded browser to navigate to an attacker-supplied URL. The firmware running on the MB181 / Voltron181 hardware (TiVo OS) fails to sanitize the destination scheme and host, permitting RFC-1918 and loopback (127.0.0.1) addresses as targets. Because the embedded browser operates with platform-level access, it can reach internal services on the TV that are isolated from external browser navigation, allowing an adjacent attacker to interact with those services using the TV as an involuntary proxy. CPE cpe:2.3:a:vestel:telefunken_te24553b45v2dz_smart_tv:*:*:*:*:*:*:*:* covers the affected product as reported by Vestel and catalogued under EUVD-2026-54481.

RemediationAI

The vendor-released patch is firmware version V2.85.2.0, which resolves the URL restriction bypass in the SmartCenter browserseturl command. Users should update the Telefunken TE24553B45V2DZ Smart TV to V2.85.2.0 or later through the device's built-in OTA update mechanism or per guidance in the Vestel security advisory (https://vestelinternational.com/security-advisories; full PDF: https://firebasestorage.googleapis.com/v0/b/vestel-shield.firebasestorage.app/o/PRODUCTION%2F4%2FVSA-4.pdf?alt=media&token=61fb45d3-b88e-4810-a620-693a1c693db4). As a compensating control prior to patching, network administrators in hospitality or enterprise deployments should isolate Smart TV VLANs from internal management networks and block LAN-to-LAN routing between guest and device-management subnets, preventing an adjacent attacker from reaching sensitive internal services through the SSRF; this measure has no impact on normal TV viewing but may affect centralized TV management systems. Blocking the SmartCenter service port at the network perimeter would eliminate the attack surface entirely but will disable SmartCenter remote-control functionality.