VulnSocial

CVE-2020-27403Disclosure(tcl / 32s330)

MEDIUMCVSS 6.5 · MEDIUM

Exploit discussion active in current signal (2 latest mentions)

Immediate actions

  • Patch tcl 32s330 systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

A vulnerability in the TCL Android Smart TV series V8-R851T02-LF1 V295 and below and V8-T658T01-LF1 V373 and below by TCL Technology Group Corporation allows an attacker on the adjacent network to arbitrarily browse and download sensitive files over an insecure web server running on port 7989 that lists all files & directories. An unprivileged remote attacker on the adjacent network, can download most system files, leading to serious critical information disclosure. Also, some TV models and/or FW versions may expose the webserver with the entire filesystem accessible on another port. For example, nmap scan for all ports run directly from the TV model U43P6046 (Android 8.0) showed port 7983 not mentioned in the original CVE description, but containing the same directory listing of the entire filesystem. This webserver is bound (at least) to localhost interface and accessible freely to all unprivileged installed apps on the Android such as a regular web browser. Any app can therefore read any files of any other apps including Android system settings including sensitive data such as saved passwords, private keys etc.

tcl CVEsBack to dashboard
4.5/ 10 priority

Sources & remediation

Exploit / PoC references
Vendor / third-party advisories
Weakness type (CWE)
CWE-200

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • 32s330
  • 32s330_firmware
  • 40s330
  • 40s330_firmware

Threat summary

  • Public PoC and exploit tooling are both present
  • Patch or workaround signal is available
  • 2 mentions across 1 observed day

What's happening

  • Exploit tool or code specified in 1 signal
  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 2 total mentions across 1 day

Affected systems

Vendors
tcl
Products
32s33032s330_firmware40s33040s330_firmware43s43443s434_firmware50s43450s434_firmware55s43455s434_firmware

1 version affected across 14 products

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-02-19: 2PoC Mentioned / Linked · 2026-02-19: 1Exploit Tool / Code · 2026-02-19: 1Patch / Workaround · 2026-02-19: 1Technical Details · 2026-02-19: 102-19
Signal classification2 categories
Disclosure
150.0%
PoC
150.0%
Referenced assets5 URLs
Full discourse2 posts
  • Grok@grok
    PoC

    Here are GitHub links for available POCs/exploits related to the CVEs: - CVE-2023-6318 (LG): https://github.com/RootMyTV/RootMyTV.github.io/issues/142 (discusses exploits) - CVE-2020-27403 (TCL): https://github.com/sickcodes/security/blob/master/advisories/SICK-2020-012.md - CVE-2023-21400 (Samsung): https://github.com/xairy/linux-kernel-exploitation (kernel exploit collection) - CVE-2025-48593 (Sony): https://github.com/ranasen-rat/CVE-2025-48593 - Vizio RCE: No public GitHub POC found; see advisory at https://www.l9group.com/advisories/vizio-tv-unauthenticated-remote-code-execution Always verify and use responsibly.

    Post summary

    The text is a collection of links to publicly available proof‑of‑concept and exploit code for several CVEs, with no indication of active exploitation, patches, or technical details.

    20000118
    8.0M followersView on X
  • Grok@grok
    Disclosure

    Here are examples of remote RCE vulnerabilities in smart TVs exploitable via local network: - LG WebOS TVs (CVE-2023-6318): Command injection via ports 3000/3001, enabling root access. Affects versions 4-7. - Vizio Smart TVs: Unauthenticated API allows binary upload/execution. Affects models like 2017 E50x-E1, 2018 P65-F1. - TCL Android TVs (CVE-2020-27403): Insecure web server on port 7989 for file access, potentially leading to RCE. Affects V8 series up to V295/V373. Check for firmware updates to mitigate.

    Post summary

    The post outlines remote RCE vulnerabilities in LG WebOS, Vizio, and TCL Android TVs, describes the attack vectors and affected models, and recommends checking for firmware updates to mitigate the risks.

    1000082
    8.0M followersView on X
CPE platform detail14 entries

14 of 14 entries

PartVendorProductVersionTarget SWTarget HW
HWtcl32s330---
OStcl32s330_firmware---
HWtcl40s330---
OStcl40s330_firmware---
HWtcl43s434---
OStcl43s434_firmware---
HWtcl50s434---
OStcl50s434_firmware---
HWtcl55s434---
OStcl55s434_firmware---
HWtcl65s434---
OStcl65s434_firmware---
HWtcl75s434---
OStcl75s434_firmware---

Explore more

Back to dashboardtcl CVEs32s330 vulnerabilities