---
id: CVE-2026-15570
title: >-
  An improper restriction of URL schemes and destinations in the SmartCenter
  browserseturl command in the Telefunken TE24553B45V2DZ Smart TV running on the
  Vestel MB181 / Voltron181 / TiVo OS platform allows an attacker with access to
  the …
summary: >-
  An improper restriction of URL schemes and destinations in the SmartCenter
  browserseturl command in the Telefunken TE24553B45V2DZ Smart TV running on the
  Vestel MB181 / Voltron181 / TiVo OS platform allows an attacker with access to
  the …
severity: none
cwe:
  - CWE-918
published: '2026-08-07'
updated: '2026-08-28'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-15570'
references:
  - url: >-
      https://firebasestorage.googleapis.com/v0/b/vestel-shield.firebasestorage.app/o/PRODUCTION%2F4%2FVSA-4.pdf?alt=media&token=61fb45d3-b88e-4810-a620-693a1c693db4
    label: 5431be70-064b-4f6a-be51-69eacabef109
  - url: 'https://vestelinternational.com/security-advisories'
    label: 5431be70-064b-4f6a-be51-69eacabef109
tags:
  - nvd
epss: 0.00207
epssPercentile: 0.11161
ingestedAt: '2026-08-29T16:39:14.351Z'
---

## Overview

An improper restriction of URL schemes and destinations in the SmartCenter browserseturl command in the Telefunken TE24553B45V2DZ Smart TV running on the Vestel MB181 / Voltron181 / TiVo OS platform allows an attacker with access to the same local network to cause the embedded browser to issue requests to unintended loopback/internal destinations, including 127.0.0.1 addresses. In demonstrated scenarios, requests initiated through the SmartCenter browserseturl mechanism could reach an internal service and receive a successful response, although the same destination was not reachable through normal browser navigation. The issue affects firmware version V2.78.0.0 and is fixed in firmware version V2.85.2.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.