Update: DHS Looking Into Cyber Risk from TCL Smart TVs

Researchers disclosed two serious vulnerabilities in TCL Android smart TVs that could allow an unprivileged remote attacker to download system files, images and application tokens (CVE-2020-27403) and allow local unprivileged attackers to read/write critical vendor resource directories including upgrade folders (CVE-2020-28055); the issues raised concerns about TCL’s remote maintenance capabilities acting as a backdoor, prompting DHS review, while TCL says it patched affected builds and disputes claims of a deliberate backdoor.