A 2022 Samsung TV Still Trusted a Compromised eMudhra Certificate, and Its Owner Used That to Swap the Ads

A 2022 Samsung smart TV accepted a forged certificate for the domain its home-screen ads load from, because the set still trusted an eMudhra certificate whose private key was recoverable. The owner, Daniel Vrátil, used that to replace the banners with family photos and published the method on November 12 in a post titled "Hijacking Samsung TV Smart Hub Ads".

The post identifies no new vulnerability in Samsung software and no CVE. The weakness it uses is the eMudhra incident, and the post states that Samsung "did not yet release an update for my TV that would revoke the certificate."

How the ads reach the screen

Vrátil had blocked the ads with Pi-hole until a homelab networking change let them back. He then intercepted the TV's HTTPS traffic with mitmproxy. The post says the TV sends a request to https://catalyst.adgrx.com/adopportunity when something happens, and fetches https://tvx.adgrx.com/impressions/tile when the user returns to Smart Hub. The reply is either {} or a JSON object describing a banner.

The TV does not let owners add their own certificate authorities. Interception worked only because the set still trusted an eMudhra certificate whose key the post calls compromised. He signed a wildcard certificate for *.adgrx.com with it, pointed his router's DNS for that domain at a NAS, and wrote a Rust server, AdSpoofer, to answer. Other *.adgrx.com requests get 204 No Content.

The post gives only "a Samsung smart TV from 2022", with no model number or firmware version. It does not say whether he reported anything to Samsung or eMudhra.

What eMudhra got wrong

According to GovInfoSecurity, eMudhra of Bengaluru issued eight intermediate CA certificates carrying private keys only one byte long, where 48 bytes were intended. Scott Helme recovered values including 4, 56, 66 and 247. eMudhra attributed it to a script deployed in April 2025, with weak certificates used for signing "because the key labels were similar."

Date	Event	Source
April 2025	Script generates the weak certificates	eMudhra, via GovInfoSecurity
May 2025	Sectigo cross-signs each deficient certificate	GovInfoSecurity
October 27, 2026	Chrome revocation expected to reach devices	GovInfoSecurity
November 12, 2026	Vrátil publishes the TV spoofing post	Vrátil

Chrome and Firefox blocked the certificates, Apple and Microsoft followed, and Go, Python, Rust, Red Hat and Ubuntu issued warnings or patches. GovInfoSecurity quotes the reason a TV stays exposed: "many other clients do not consume revocation information." A television with a fixed trust store waits for a vendor firmware push.

What it does and does not show

Spoofing the ad domain on a home network needs control of that network's DNS and routing. Vrátil is the router's owner, so this is an owner exercising control rather than a remote attack. The same trust gap would let someone on the path between the TV and the internet impersonate any server whose certificate chains to the distrusted CA, which is the risk Cloudflare raised. Stale credentials that stay valid long after the damage is known are a pattern, as in the Zeabur admin token report and Wiz's count of nine breached developer platforms.

He adds the spoofing will stop when the certificate expires or Samsung revokes it, and that blocking TV updates could preserve it. Samsung has published no revocation update that the post cites.