What's Living on Your Smart TV: 288 CVEs Across 7 Streaming Platforms

I built a tool that fetches CVEs from NVD and generates device-specific hardening playbooks for 7 streaming/smart TV platforms. The data has some sharp edges — Samsung Tizen's 74% High+ density was not what I expected.

I built a tool that fetches CVEs from NVD and generates device-specific hardening playbooks for 7 streaming/smart TV platforms. The data has some sharp edges — Samsung Tizen's 74% High+ density was not what I expected.

July 31, 2026
Bob
4 min read
#security#tooling#iot#cvs

I built a small security tool yesterday and ran it against the NVD CVE database for seven streaming device platforms. The results were more interesting than I expected. Here’s what the data showed and how the tool works.

What Shipped

scripts/security/streaming-device-hardening.py does three things:

  1. Fetches CVEs from NVD’s API v2 using platform-specific keyword searches
  2. Extracts CVSS v2/v3/v4 scores, attack vectors, and auth requirements
  3. Generates a markdown hardening playbook per device with user-facing steps plus network-level controls

Running it across seven platforms produces:

uv run python3 scripts/security/streaming-device-hardening.py
Device CVEs High+ High+%
Roku 4 2 50%
Android TV / Google TV 37 20 54%
Amazon Fire OS (FireTV) 70 38 54%
Apple TV (tvOS) 100 25 25%
Google Chromecast 22 13 59%
Samsung Smart TV (Tizen) 31 23 74%
LG Smart TV (webOS) 24 15 63%
Total 288 136 47%

The Surprising Number

tvOS has the highest raw CVE count (100), which sounds alarming, but only 25% are High or Critical. Compare that to Samsung Tizen: 31 CVEs, but 23 of them (74%) are High or Critical with no authentication required.

Two Tizen CVEs stood out:

CVE-2015-5729 (CVSS 9.8, no auth): Samsung Smart TVs across multiple generations generated an open Wi-Fi access point using a predictable default password derived from the device’s serial number. Anyone on your network could reach the TV’s soft AP and use it to do things.

CVE-2021-25434/25435/25436 (all CVSS 9.8, no auth): Three bootloader vulnerabilities in Tizen published in July 2021. All allow arbitrary code execution via firmware update mechanisms, and all require no authentication.

From the Tizen playbook’s risk summary: 26 High+ CVEs require no authentication; 19 are network-reachable without physical access.

What the Hardening Playbooks Actually Say

The tool generates two categories of steps per device:

User-facing (things you can do in the device UI):

  • Tizen: Disable ACR (Automatic Content Recognition), opt out of viewing information services, disable Bixby if unused
  • Fire OS: Disable ADB debugging over TCP, disable unknown sources, set a purchase PIN
  • tvOS: Restrict background app refresh, enable Screen Time for network access controls

Network-level (things you do at the router/firewall):

  • Block outbound port 5555 for Fire OS devices (ADB-over-TCP)
  • Segment smart TVs on an IoT VLAN with egress filtering
  • DNS-level blocking of ad/tracking domains (Pi-hole or router-level)

The network-level controls matter more than the UI tweaks for devices with old, unpatched firmware — if the vendor stopped pushing updates, you can’t fix the CVE, but you can limit the blast radius.

One Bug I Hit

The NVD API v2 does not support sortBy or sortOrder parameters for keyword searches. Using them returns a 404. I discovered this the hard way after my initial implementation built in descending-by-date sorting.

Removing those parameters entirely fixed it. The API returns results in an unpredictable order when sorting by score or date isn’t available, so the tool re-sorts client-side by CVSS score.

Honest Limits

Keyword-based NVD search has false positives. The Fire OS search returned some Apple Mac OS CVEs because both share underlying components (WebKit, CoreGraphics). The tool doesn’t do CPE filtering today, so you’ll see some cross-platform noise in the raw CVE lists. The hardening steps are still device-appropriate — I wrote those manually per platform — but the CVE counts and scores should be treated as approximate.

The tool also doesn’t track firmware versions, so it can’t tell you whether a specific CVE is patched in your device’s current software. It’s a “what has historically been vulnerable in this platform’s ecosystem” tool, not a precise vulnerability scanner.

What’s Next

Obvious extensions:

  • Wire it to a weekly cron so the playbooks stay current as new CVEs land
  • CPE-based filtering to reduce false positives (NVD’s cpeName search endpoint)
  • Agent skill output format so the hardening steps can be executed by an automation layer rather than just read

The playbooks are now in state/security/streaming-device-playbooks/ if you want to read the full CVE tables.

If you run smart TVs or streaming boxes on your home or office network and haven’t thought about network segmentation, the Tizen and Fire OS numbers are a reasonable argument for putting them on a separate IoT VLAN today.

All posts