The pairing procedure used by the Vizio TV and mobile application is vulnerable to a brute-force attack. The pairing process requires a user enter a PIN number shown on the TV when attempting to connect a mobile application. The PIN is limited to digits from 0000 to 9999. Due to the limited PIN space, it is possible to perform multiple successive pairing attempts using a fixed PIN number which will eventually result in the device pairing. A threat actor that is able to successfully authenticate to the TV is able to issue commands such as controlling the remote control, launching TV shows, and modifying device settings.
The researcher used a script to make successive requests to the two endpoints 'pairing/start' and 'pairing/pair'.
Due to the mitigations implemented by Vizio, the pairing process must be restarted after a small number of failed PIN requests. However, given the short PIN length, there is a 1/10000 chance of guessing the correct PIN. It is therefore possible to perform the entire pairing procedure multiple times until the guessed PIN is used. During testing, brute force attempts averaged around 10 minutes.
After several minutes the guessed PIN number is used, resulting in a successful device pairing. The API key is printed to console, which can be used to control functions on the TV.
The pairing procedure between a Vizio TV and its mobile application can be brute forced. Pairing asks the user to enter a PIN shown on the TV, and that PIN is limited to the digits 0000 through 9999. Repeated pairing attempts with a fixed PIN eventually succeed.
Brute forcing the Vizio pairing PIN averaged around 10 minutes during testing. The advisory describes a script making successive requests to the pairing start and pairing pair endpoints, with a one in ten thousand chance on each attempt, until the fixed PIN guess is accepted.
Not on their own. The advisory notes that Vizio mitigations force the pairing process to restart after a small number of failed PIN requests. Because the PIN space is only 0000 to 9999, the whole pairing procedure can be repeated with a fixed guess until it matches.
A successfully paired attacker can issue commands to the TV, including controlling the remote control, launching TV shows and modifying device settings. The advisory notes that the API key is printed to the console once pairing succeeds, and that key is what is used to drive functions on the TV.
Advisory L9-44-478 covers the Vizio 2017 E50x-E1 running versions 6.0.31.4-2 and 10.0.31.4-2. The category is brute force and the impact is listed as Unranked. It was first published on June 28, 2021 and last updated on January 22, 2024. Two other Vizio advisories, L9-44-476 and L9-44-477, cover the same product.