Millions of TCL Smart TVs Can Be Accessed by Hackers Remotely

By Bill Toulas / November 13, 2020

TCL, the Chinese tech giant who also happens to be the third-largest TV manufacturer in the world, is dealing with a nasty code security problem. As discovered by white-hat hackers, knowing the target TV’s IP address is all that it would take for a threat actor to access it and browse its hidden files. The only tools needed for this would be something to use for port scanning, like Nmap, for example, and a web browser for browsing the filesystem.

The victim, in that case, wouldn’t realize that someone has accessed their TV, so everything would unfold silently. The researchers figured that “” doesn’t have any protection against remote access whatsoever. Through there, a capable hacker could plant code in the smart TV, inject malicious files, delete others, exfiltrate what’s there, and more.

TCL was notified of the discoveries but didn’t respond until after 13 days had passed. Their answer was peculiar, as they claimed to the fixed the problem. When the researchers went to confirm that, they saw that TCL’s engineers had moved some critical files around, but access to the filesystem and editing of the files was still possible for remote actors.

It is now accepted that TCL may not do much to fix the problem, leaving millions of people at risk. TCL TVs are selling very well as they’re generally pretty good while maintaining the price at lower levels. However, this is not the first time that TCL has blundered on the privacy and security space, and in fact, it’s not even the second time.

If you own and use a TCL TV, there are a couple of things you can do to mitigate the risks.

For a better user experience we recommend using a more modern browser. We support the latest version of the following browsers: For a better user experience we recommend using the latest version of the following browsers: Chrome, Edge, Firefox, Safari