Some models have different open port for webserver with root fs (7983)

[brozkeff]

Related to https://github.com/sickcodes/security/blob/master/advisories/SICK-2020-009.md / CVE-2020-27403

Tested on TCL U43P6064 with Android 8.0 (version 501 or something like that, cannot find the exact version on the TV anymore). Installed f-droid on the TV and NetworkMapper (nmap) and scanned all ports on localhost (127.0.0.1). Serveral open ports, and port 7983 contained the same http server with the entire fs available for free. Any app could this way access anything, bypassing all security. Not binded to wifi ip address, however, perhaps already fixed remotely by TCL. Localhost binding still present and several other services available via localhost as well: particularly nmap found these open ports bound to 127.0.0.1 with 7983/tcp (http) containing the webserver with the filesystem.

Open TCP ports found via nmap:

• 6553
• 53130
• 10101
• 12854
• 8009
• 8008
• 8443
• 6466
• 6467
• 9080
• 7983 - http, entire filesystem freely accessible
• 6557
• 9000
• 6550
• 8012
• 6559
• 4332

Some data returned but fingerprint not detected by nmap:

• 6550 (TLSSessionReq...)
• 6559 (tv_start=>390=>-3=>tv_end)
• 8009 (received some self-signed RSA-2048 cert)
• 9080 (http, Server: NRDP/2020.1.3.1)

[brozkeff]

Proof. Edge browser (unprivileged app) on TV opening webserver with entire fs at its fingertips

[brozkeff]

Confirmed vulnerability not just from localhost but also from LAN.

Discovered SQlite db of supported TV models of the FW.

Whopping 235 models of TVs are probably affected, branded TCL, Thomson and others:

ClientType ModelName TCL-EU-MT58K-S1 L55E5700A-UD TCL-EU-MT58K-S1 U55S896 TCL-EU-MT58K-S1 U65S996 TCL-EU-MT58K-S1 U40S696 TCL-EU-MT58K-S1 U55S896 TCL-EU-MT58K-S1 U40S696 TCL-EU-MT58K-S1 U50S796 TCL-AP-MT58K-S1 65X1QUS TCL-AU-MT5658-S1 65X1QUS TCL-LA-MT5658-S1 55P1US TCL-LA-MT5658-S1 75C2US TCL-EU-MT58K-S1 U65S996 TCL-CA-MT58CF-S1 55P1MUS THOM-EU-MT58K-S1 55UC646 THOM-EU-MT58K-S1 49UC646 THOM-EU-MT58K-S1 43UC646 TCL-EU-MT58K-S1 U49P606 TCL-EU-MT58K-S1 U55P606 THOM-EU-MT58K-S1 65UC646 TCL-EU-MT58K-S1 U65P606 TCL-EU-MT58K-S1 U43P606 TCL-AP-MT58K-S1 55C2US TCL-AP-MT58K-S1 55C2US TCL-ME-MT58K-S1 55C2US TCL-AP-MT58K-S1 49C2US TCL-AP-MT58K-S1 49C2US TCL-ME-MT58K-S1 49C2US TCL-AP-MT58K-S1 65C2US TCL-AP-MT58K-S1 65C2US TCL-ME-MT58K-S1 65C2US TCL-EU-MT58K-S1 U49C706 TCL-EU-MT58K-S1 U55C706 TCL-EU-MT58K-S1 U65C706 TCL-AU-MT5658-S1 49C2US TCL-AU-MT5658-S1 55C2US TCL-AU-MT5658-S1 65C2US THOM-EU-MT58K-S1 55UC656 THOM-EU-MT58K-S1 65UC656 TCL-AU-MT5658-S1 50P20US TCL-AU-MT5658-S1 55P20US TCL-AU-MT5658-S1 60P20US TCL-AU-MT5658-S1 65P20US TCL-LA-MT5658-S1 49C2US TCL-LA-MT5658-S1 55C2US TCL-LA-MT5658-S1 65C2US TCL-CA-MT58CF-S1 49C2US TCL-CA-MT58CF-S1 55C2US TCL-EU-MT58K-S1 U43P646 THOM-EU-MT58K-S1 43UC646 TCL-AP-MT58K-S1 55X3US TCL-AP-MT58K-S1 55X3US TCL-ME-MT58K-S1 55X3US TCL-AP-MT58K-S1 65X3US TCL-AP-MT58K-S1 65X3US TCL-ME-MT58K-S1 65X3US THOM-EU-MT58K-S1 49UC766 THOM-EU-MT58K-S1 55UC766 THOM-EU-MT58K-S1 65UC766 TCL-CA-MT58CF-S1 55C2US TCL-LA-MT5658-S1 65X3CUS TCL-AU-MT5658-S1 55X2US TCL-AU-MT5658-S1 65X2US TCL-AU-MT5658-S1 75C2US TCL-EU-MT58K-S1 U55X906 TCL-EU-MT58K-S1 U65X906 TCL-LA-MT5658-S1 75C2US TCL-EU-MT58K-S1 U50P606 THOM-EU-MT58K-S1 65UC646 TCL-EU-MT58K-S1 U65P606 TCL-AP-MT58K-S1 L55P2MUS TCL-EU-MT58K-S1 U55C706 THOM-EU-MT58K-S1 55UC656 TCL-EU-MT58K-S1 U75C706 TCL-EU-MT58K-S1 U60P606 TCL-EU-MT58K-S1 U49S706 TCL-EU-MT58K-S1 U55S706 TCL-EU-MT58K-S1 U65S706 THOM-EU-MT58K-S1 50UC646 TCL-EU-MT58K-S1 U49C706 TCL-CA-MT58CF-S1 55C2US TCL-CA-MT58CF-S1 49C2US TCL-LA-MT5658-S1 49C2US TCL-AP-MT58K-S1 49C2US TCL-ME-MT58K-S1 49C2US TCL-AP-MT58K-S1 49C2US TCL-AU-MT5658-S1 65P20US TCL-ME-MT58K-S1 75C2US THOM-EU-MT58K-S1 65UC766 TCL-EU-MT58K-S1 U65S706 TCL-AP-MT58K-S1 55C2US TCL-AP-MT58K-S1 55C2US TCL-ME-MT58K-S1 55C2US TCL-AP-MT58K-S1 L65P2MUS TCL-AU-MT5658-S1 55C2US TCL-LA-MT5658-S1 55C2US TCL-AU-MT5658-S1 49C2US THOM-EU-MT58K-S1 55UC656 TCL-LA-MT5658-S1 49C2US TCL-AU-MT5658-S1 55X2US TCL-AU-MT5658-S1 70C2US TCL-AP-MT58K-S1 75C2US TCL-LA-MT5658-S1 49C2US TCL-ME-MT58K-S1 70C2US TCL-ME-MT58K-S1 U49C706 TCL-ME-MT58K-S1 U65C706 TCL-AU-MT5658-S1 65C2US TCL-LA-MT5658-S1 65C2US TCL-AP-MT58K-S1 I49 TCL-AP-MT58K-S1 I55 TCL-ME-MT58K-S1 65X3US TCL-AP-MT58K-S1 65C2US TCL-AP-MT58K-S1 65C2US TCL-ME-MT58K-S1 65C2US TCL-EU-MT58K-S1 U65C706 TCL-ME-MT58K-S1 75C2US TCL-LA-MT5658-S1 49C2US TCL-LA-MT5658-S1 55C2US TCL-LA-MT5658-S1 65X3CUS TCL-LA-MT5658-S1 75C2US TCL-AU-MT5658-S1 60P20US TCL-ME-MT58K-S1 U65X906 TCL-AU-MT5658-S1 65P20US TCL-EU-MT58K-S1 U55P606 TCL-EU-MT58K-S1 U65P606 TCL-ME-MT58K-S1 U49C706 TCL-ME-MT58K-S1 U55C706 TCL-EU-MT58K-S1 50DP660 TCL-EU-MT58K-S1 55DP660 TCL-AP-MT58K-S1 55C2US TCL-AU-MT5658-S1 65E17NUS TCL-AU-MT5658-S1 55E17NUS TCL-AU-MT5658-S1 85X6US TCL-AU-MT5658-S1 55P6US TCL-ME-MT58K-S1 U65C706 TCL-AP-MT58K-S1 50P6US TCL-AU-MT5658-S1 50P6US TCL-AU-MT5658-S1 65P6US TCL-AP-MT58K-S1 55P6US TCL-EU-MT58K-S1 U55P606 THOM-EU-MT58K-S1 55UC646 TCL-EU-MT58K-S1 85X6US TCL-EU-MT58K-S1 55V6 TCL-EU-MT58K-S1 65DP660 TCL-AU-MT5658-S1 85X6US TCL-ME-MT58K-S1 85X6US TCL-AU-MT5658-S1 49C6US TCL-AU-MT5658-S1 55C6US/55C8 TCL-AU-MT5658-S1 65C6US TCL-AU-MT5658-S1 70C4US TCL-AU-MT5658-S1 75C4US TCL-AU-MT5658-S1 65X4US TCL-AU-MT5658-S1 55X4US/55X7 TCL-EU-MT58K-S1 U70C70*6 TCL-LA-MT5658-S1 85X6US THOM-EU-MT58K-S1 55UC6596 TCL-AP-MT58K-S1 55X4US TCL-AP-MT58K-S1 65X4US TCL-AP-MT58K-S1 55K2A TCL-AU-MT5658-S1 60C4US TCL-AP-MT58K-S1 85X6US TCL-AP-MT58K-S1 65X4US TCL-AP-MT58K-S1 55X4US TCL-AU-MT5658-S1 60P20US TCL-AP-MT58K-S1 L55P2MUS TCL-LA-MT5658-S1 55C6US TCL-LA-MT5658-S1 49C6US TCL-AP-MT58K-S1 49C6US TCL-AP-MT58K-S1 49C6US TCL-ME-MT58K-S1 49C6US TCL-AP-MT58K-S1 55C6US/55C6 TCL-AP-MT58K-S1 55C6US TCL-ME-MT58K-S1 55C6US TCL-AU-MT5658-S1 60P4US TCL-ME-MT58K-S1 65X3US TCL-EU-MT58K-S1 55DC760 TCL-EU-MT58K-S1 65DC760 THOM-EU-MT58K-S1 55UD6406 THOM-EU-MT58K-S1 50UD6406 THOM-EU-MT58K-S1 43UD6406 TCL-AP-MT58K-S1 65C6US TCL-AP-MT58K-S1 65C6US TCL-ME-MT58K-S1 65C6US TCL-LA-MT5658-S1 65C6US TCL-AP-MT58K-S1 75C2US TCL-AP-MT58K-S1 65X2US TCL-AP-MT58K-S1 65X4US TCL-ME-MT58K-S1 65X4US TCL-AP-MT58K-S1 55X4US TCL-ME-MT58K-S1 55X4US TCL-AP-MT58K-S1 75C2US TCL-AP-MT58K-S1 75C2US TCL-ME-MT58K-S1 75C2US TCL-LA-MT5658-S1 75C2US TCL-EU-MT58K-S1 U75C7006 TCL-AU-MT5658-S1 75C4US/75C8 TCL-AP-MT58K-S1 65H2A TCL-AP-MT58K-S1 75H2A TCL-AP-MT58K-S1 65X4U TCL-AP-MT58K-S1 43P65US/43P8M TCL-EU-MT58K-S1 65P5 TCL-EU-MT58K-S1 75X5 THOM-EU-MT58K-S1 65UD6406 TCL-ME-MT58K-S1 65C2US THOM-EU-MT58K-S1 50UD6406 TCL-AP-MT58K-S1 65C6US TCL-AP-MT58K-S1 50P65US TCL-AP-MT58K-S1 55C6US TCL-AP-MT58K-S1 65K2A TCL-AP-MT58K-S1 75H2A TCL-AP-MT58K-S1 75C2US TCL-CA-MT58CF-S1 55P6US TCL-ME-MT58K-S1 55C6US TCL-AU-MT5658-S1 70C4US TCL-ME-MT58K-S1 65C6US TCL-AU-MT5658-S1 65C6US/65C8 TCL-ME-MT58K-S1 65C6US TCL-AP-MT58K-S1 65C6US/65C6 TCL-ME-MT58K-S1 65C6US TCL-EU-MT58K-S1 65DC760 TCL-ME-MT58K-S1 75C2US TCL-AU-MT5658-S1 65P6US TCL-CA-MT58CF-S1 55C6US TCL-CA-MT58CF-S1 65C6US TCL-EU-MT58K-S1 65DP660 TCL-AU-MT5658-S1 65X8 TCL-AU-MT5658-S1 75P8M TCL-LA-MT5658-S1 55C6US TCL-LA-MT5658-S1 65C6US TCL-AP-MT58K-S1 65X4US/65V2A TCL-AU-MT5658-S1 65X7 TCL-AP-MT58K-S1 65X4US TCL-AP-MT58K-S1 65V2A TCL-AU-MT5658-S1 70P8M TCL-AU-MT5658-S1 85P8M TCL-AP-MT58K-S1 85P8M

[sickcodes]

Thanks I have forwarded to VP of TCL USA & Engineering team as the Security team hasn't been invented yet.

[sickcodes]

Closing out since this was fixed, see https://www.tcl.com/global/en/news/alert-vulnerabilities-found-in-tcl-android-tvs.html