Skip to content
Fencer Vulns
medium 6.5

CVE-2020-27403 json

A vulnerability in the TCL Android Smart TV series V8-R851T02-LF1 V295 and below and V8-T658T01-LF1 V373 and below by TCL Technology Group…

published 2020-11-10 5 y ago modified 2026-06-17 4 mo ago also EUVD-2020-19914

cvss
6.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.7%
EPSS 2.7% chance of exploitation in 30 days, percentile 86%
public exploits
0
none known

Summary

A vulnerability in the TCL Android Smart TV series V8-R851T02-LF1 V295 and below and V8-T658T01-LF1 V373 and below by TCL Technology Group Corporation allows an attacker on the adjacent network to arbitrarily browse and download sensitive files over an insecure web server running on port 7989 that lists all files & directories. An unprivileged remote attacker on the adjacent network, can download most system files, leading to serious critical information disclosure. Also, some TV models and/or FW versions may expose the webserver with the entire filesystem accessible on another port. For example, nmap scan for all ports run directly from the TV model U43P6046 (Android 8.0) showed port 7983 not mentioned in the original CVE description, but containing the same directory listing of the entire filesystem. This webserver is bound (at least) to localhost interface and accessible freely to all unprivileged installed apps on the Android such as a regular web browser. Any app can therefore read any files of any other apps including Android system settings including sensitive data such as saved passwords, private keys etc.

Patch / fix

  • tcl 32s330_firmware v8-r851t10-lf1v091
  • tcl 40s330_firmware v8-r851t10-lf1v091
  • tcl 43s434_firmware v8-r851t02-lf1v440
  • tcl 50s434_firmware v8-r851t02-lf1v440
  • tcl 55s434_firmware v8-r851t02-lf1v440
  • tcl 65s434_firmware v8-r851t02-lf1v440
  • tcl 75s434_firmware v8-r851t02-lf1v440

Exploit prediction

2.72% chance of exploitation in the next 30 days, higher than 86% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/sickcodes/security/blob/master/advisories/SICK-2020-009.md referenced PoC, tagged "exploit" by a source, unverified
  • sick.codes https://sick.codes/sick-2020-009 referenced PoC, tagged "exploit" by a source, unverified
  • sick.codes https://sick.codes/extraordinary-vulnerabilities-discovered-in-tcl-android-tvs-now-worlds-3rd-largest-tv-manufacturer/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 3.3 AV:A/AC:L/Au:N/C:P/I:N/A:N

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.