Code-27-Companion-Hub-Exploits

Code 27 3D Companion Hub の脆弱性 CVE-2026-36027, CVE-2026-36028 Code 27 3D Companion Hub は、カスタム AI キャラクター（"Codie"）をアニメーション 3D コンパニオンとして表示する物理デスクトップデバイスです。ユーザーは任意の 3D モデルをアップロードまたは作成でき、マルチモーダル AI により、キャラクターは周囲を見て、口調やボディランゲージを読み取り、自由な会話を行うことができます。 この記事では、デバイスへの物理的アクセスを必要とする 2...

CVE-2026-36027: Hardware Allows Activation of Test or Debug Logic at Runtime

An issue in Code27 Companion Hub SQ3A.220705.003.A1 allows a physically proximate attacker to execute arbitrary code via the USB debugging ADB and Android Debug Bridge components...

CVE-2026-36028

A protection mechanism failure in the Code 27 Companion Hub allows an attacker with physical access to completely bypass kiosk restrictions via a factory reset...

CVE-2026-36027

The Code 27 3D Companion Hub (Build SQ3A.220705.003.A1 , Android 12) contains a vulnerability allowing a physically proximate attacker to execute arbitrary code via USB debugging (ADB) . Because the device ships a userdebug build, an attacker can boot the device into recovery mode and restart adb...

PT-2026-56535

Name of the Vulnerable Software and Affected Versions Code 27 Companion Hub affected versions not specified Description A protection mechanism failure allows an attacker with physical access to completely bypass kiosk restrictions by performing a factory reset. Recommendations At the moment, ther...

CVE-2026-36028

The Code 27 3D Companion Hub (UI version 1.2.0, running Android 12 on Rockchip RK3588S ) is vulnerable to a protection mechanism failure. An attacker with physical access can perform a factory reset via the Android recovery menu. Because the kiosk application is stored in the userdata partition r...

CVE-2026-36027

An issue in Code27 Companion Hub SQ3A.220705.003.A1 allows a physically proximate attacker to execute arbitrary code via the USB debugging ADB and Android Debug Bridge components...

CVE-2026-36028: Authentication Bypass Using an Alternate Path or Channel

A protection mechanism failure in the Code 27 Companion Hub allows an attacker with physical access to completely bypass kiosk restrictions via a factory reset...

CVE-2026-36027

An issue in Code27 Companion Hub SQ3A.220705.003.A1 allows a physically proximate attacker to execute arbitrary code via the USB debugging ADB and Android Debug Bridge components...

CVE-2026-36028

A protection mechanism failure in the Code 27 Companion Hub allows an attacker with physical access to completely bypass kiosk restrictions via a factory reset...

PT-2026-56534

An issue in Code27 Companion Hub SQ3A.220705.003.A1 allows a physically proximate attacker to execute arbitrary code via the USB debugging ADB and Android Debug Bridge components...

CVE-2026-36028

A protection mechanism failure in the Code 27 Companion Hub allows an attacker with physical access to completely bypass kiosk restrictions via a factory reset...