PatchTheCVECVE-2026-15570: An improper restriction of URL schemes and destinations in the SmartCenter browserseturl command in the Telefu
29
Routine
HIGH 7.1
CVE-2026-15570 is a high-severity flaw (CVSS 7.1) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
An improper restriction of URL schemes and destinations in the SmartCenter browserseturl command in the Telefunken TE24553B45V2DZ Smart TV running on the Vestel MB181 / Voltron181 / TiVo OS platform allows an attacker with access to the same local network to cause the embedded browser to issue requests to unintended loopback/internal destinations, including 127.0.0.1 addresses. In demonstrated scenarios, requests initiated through the SmartCenter
Why this priority
- High severity
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 7.1 (High) |
| Attack vector | Adjacent network |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.3% (top 83%) |
| CISA exploited list | No |
| Weakness | CWE-918 |
| Published | 2026-08-07 |
| Last modified | 2026-10-23 |
Publisher (CNA): Vestel
Timeline
- Published CVE record published
- Updated Record last modified
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.