Johnjhacking

A threat actor with access to the admin panel can create a new Advertisement via the Advertising function and save an XSS payload in the body of the HTML document. This payload will execute globally on the client side.

A vulnerability in the TCL Android Smart TV series allows an attacker on the adjacent network to arbitrarily browse and download sensitive files over an insecure web server running on port 7989 that lists all files & directories. An unprivileged remote attacker on the adjacent network can download most system files, leading to serious critical information disclosure. Some TV models and/or firmware versions may expose the web server with the entire file system accessible on another port.

A local unprivileged attacker, such as a malicious App, can read and write to the `/data/vendor/tcl`, `/data/vendor/upgrade`, and `/var/TerminalManager` directories within the TV file system. This allows an attacker, such as a malicious APK or local unprivileged user, to perform fake system upgrades by writing to the `/data/vendor/upgrade` folder.