TCL was recently notified by an independent security researcher of two vulnerabilities in Android TV models. Once TCL received notification, the company quickly took steps to investigate, thoroughly test, develop patches, and implement a plan to send updates to resolve the matter. Updating devices and applications to enhance security is a regular occurrence in the technology industry, and these updates are currently being distributed to all affected Android TV models.  

TCL takes privacy and security very seriously, and particularly appreciates the vital role that independent researchers play in the technology ecosystem. We wish to thank the security researchers for bringing this matter to our attention as we work to advance the user experience. We are committed to bringing consumers secure and robust products, and we’re confident that we’re putting in place effective solutions for these devices.

FAQ

Who discovered these vulnerabilities
The discovery was made by two industry researchers @sickcodes and @johnjhacking.

Do these vulnerabilities apply to models sold in the USA or Canada?
CVE-2020-27403 is not an issue in product deployed in North America.  However, select televisions sold in the USA and Canada were affected by CVE-2020-28055; the updated television software versions listed below solve this.  

To ensure your set has the latest firmware, click the section below to view the instructions on how to view the software on your TCL Android TV.

When was TCL made aware of these vulnerabilities?
The TCL lab was made aware of the discovery at 11:30am on October 27.  Within hours, the issues had been verified and the security compliance team triggered the vulnerability management response process.  The solution for CVE-2020-27403 began deployment on October 30 via APK upgrade. Updated firmware is being distributed to address CVE-2020-28055.  To ensure your set has the latest firmware, click the section below to view the instructions on how to view the software on your TCL Android TV.