CVE-2026-119737

The pppoe_wrapper vendor daemon in the Amlogic Android SDK , specifically on Nexbox A95X (Amlogic S905/S905X) TV boxes, is vulnerable to a command injection flaw. A local attacker can execute arbitrary commands as root by sending crafted messages to a world-writable AF_UNIX datagram socket at /de...

CVE-2026-119737 Amlogic pppoe_wrapper Command Injection via AF_UNIX Socket

The pppoewrapper vendor daemon from the Amlogic Android SDK, as shipped on Nexbox A95X Amlogic S905/S905X TV boxes, contains a command injection vulnerability that allows local attackers to execute arbitrary commands as root by sending crafted messages to a world-writable AFUNIX datagram socket a...