189 matches found
sonos
sonos/amlogic haxx here you will find some exploit & tool code that was part of my presentation about the Sonos One @ Hack in the Box amsterdam 2023. the EL3 exploit can be used to dump your OTP/eFUSE data. sonostool can be used to get decryption keys for Sonos LUKS volumes as well as fetch and...
CVE-2026-119739
The VobSub subtitle decoder libsubvob part of the Amlogic DroidLogic SubTitleService, as shipped on Nexbox A95X Amlogic S905X TV boxes, contains an out-of-bounds write vulnerability in vobfillpixel that allows remote attackers to corrupt stack memory by sending a crafted SETCONTR command with an...
CVE-2026-119740 Nexbox A95X Amlogic S905X UART Unauthenticated Console Access
Nexbox A95X TV boxes built on the Amlogic S905X platform contain an unauthenticated console exposed via an internal UART header on the PCB that allows physical attackers to obtain an interactive shell as uid 2000 system without any credentials. Attackers with physical access and a USB-to-TTL...
CVE-2026-119740
The Nexbox A95X TV boxes built on the Amlogic S905X platform are vulnerable to a multi-stage attack leading to full root-level compromise. Physical attackers can access an unauthenticated console via an internal UART header on the PCB using a USB-to-TTL adapter to obtain an interactive shell as u...
CVE-2026-119739 Amlogic DroidLogic SubTitleService Out-of-Bounds Write via VobSub SET_CONTR
The VobSub subtitle decoder libsubvob part of the Amlogic DroidLogic SubTitleService, as shipped on Nexbox A95X Amlogic S905X TV boxes, contains an out-of-bounds write vulnerability in vobfillpixel that allows remote attackers to corrupt stack memory by sending a crafted SETCONTR command with an...
CVE-2026-119739 Amlogic DroidLogic SubTitleService Out-of-Bounds Write via VobSub SET_CONTR
The VobSub subtitle decoder libsubvob part of the Amlogic DroidLogic SubTitleService, as shipped on Nexbox A95X Amlogic S905X TV boxes, contains an out-of-bounds write vulnerability in vobfillpixel that allows remote attackers to corrupt stack memory by sending a crafted SETCONTR command with an...
CVE-2026-119739
The libsub_vob VobSub subtitle decoder, part of the Amlogic DroidLogic SubTitleService on Nexbox A95X (Amlogic S905X) TV boxes, contains an out-of-bounds write vulnerability in the vob_fill_pixel() function. An attacker can provide a crafted SET_CONTR command with a malicious alpha value, causing...
CVE-2026-119738
The libsub_vob VobSub subtitle decoder, component of the Amlogic DroidLogic SubTitleService on Nexbox A95X (Amlogic S905X) TV boxes, contains an infinite loop vulnerability in the get_vob_spu() function. This issue is caused by mismatched length fields that trigger an unreachable loop exit condit...
CVE-2026-119738 Amlogic DroidLogic SubTitleService Infinite Loop via get_vob_spu()
The VobSub subtitle decoder libsubvob part of the Amlogic DroidLogic SubTitleService, as shipped on Nexbox A95X Amlogic S905X TV boxes, contains an infinite loop vulnerability in getvobspu that allows unauthenticated network attackers or local users loading malicious files to trigger an unreachab...
CVE-2026-119737 Amlogic pppoe_wrapper Command Injection via AF_UNIX Socket
The pppoewrapper vendor daemon from the Amlogic Android SDK, as shipped on Nexbox A95X Amlogic S905/S905X TV boxes, contains a command injection vulnerability that allows local attackers to execute arbitrary commands as root by sending crafted messages to a world-writable AFUNIX datagram socket a...
CVE-2026-119737
The pppoe_wrapper vendor daemon in the Amlogic Android SDK , specifically on Nexbox A95X (Amlogic S905/S905X) TV boxes, is vulnerable to a command injection flaw. A local attacker can execute arbitrary commands as root by sending crafted messages to a world-writable AF_UNIX datagram socket at /de...
Astra Linux – vulnerability in linux-6.1
In the Linux kernel, the following vulnerability has been resolved: crypto: amlogic - avoid double cleanup in mesoncryptoprobe When mesonallocatechanlist fails due to a partial allocation, it unwinds the allocated chanlist state via its local error path. mesoncryptoprobe then jumps to errorflow a...
CVE-2026-119740: Nexbox A95X: Nexbox A95X TV boxes built on the Amlogic S905X platform contain an unauthenticated console exposed via an internal…
Nexbox A95X TV boxes built on the Amlogic S905X platform contain an unauthenticated console exposed via an internal UART header on the PCB that allows physical attackers to obtain an interactive shell as uid 2000 system without any credentials. Attackers with physical access and a USB-to-TTL...
PT-2026-135664
The pppoe wrapper vendor daemon from the Amlogic Android SDK, as shipped on Nexbox A95X Amlogic S905/S905X TV boxes, contains a command injection vulnerability that allows local attackers to execute arbitrary commands as root by sending crafted messages to a world-writable AF UNIX datagram socket...
mitv4-utgard-lpe
MiTV4 Amlogic Utgard — local privilege escalation via unvali...
Linux Distros Unpatched Vulnerability : CVE-2026-93249
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: spi: amlogic-spisg: Make sure clkinitdata is fully initialized The clkinitdata structure...
CVE-2026-93249
In the Linux kernel, the following vulnerability has been resolved: spi: amlogic-spisg: Make sure clkinitdata is fully initialized The clkinitdata structure contains several mutually-exclusive members for different methods to specify the possible parents of a clock, prompting drivers to initializ...
UBUNTU-CVE-2026-93249
In the Linux kernel, the following vulnerability has been resolved: spi: amlogic-spisg: Make sure clkinitdata is fully initialized The clkinitdata structure contains several mutually-exclusive members for different methods to specify the possible parents of a clock, prompting drivers to initializ...
CVE-2026-93249 spi: amlogic-spisg: Make sure clk_init_data is fully initialized
In the Linux kernel, the following vulnerability has been resolved: spi: amlogic-spisg: Make sure clkinitdata is fully initialized The clkinitdata structure contains several mutually-exclusive members for different methods to specify the possible parents of a clock, prompting drivers to initializ...
EUVD-2026-86261
In the Linux kernel, the following vulnerability has been resolved: spi: amlogic-spisg: Make sure clkinitdata is fully initialized The clkinitdata structure contains several mutually-exclusive members for different methods to specify the possible parents of a clock, prompting drivers to initializ...