CVE-2026-119737

The pppoewrapper vendor daemon from the Amlogic Android SDK, as shipped on Nexbox A95X Amlogic S905/S905X TV boxes, contains a command injection vulnerability that allows local attackers to execute arbitrary commands as root by sending crafted messages to a world-writable AFUNIX datagram socket a...

CVE-2026-119740

The Nexbox A95X TV boxes built on the Amlogic S905X platform are vulnerable to a multi-stage attack leading to full root-level compromise. Physical attackers can access an unauthenticated console via an internal UART header on the PCB using a USB-to-TTL adapter to obtain an interactive shell as u...

CVE-2026-119740 Nexbox A95X Amlogic S905X UART Unauthenticated Console Access

Nexbox A95X TV boxes built on the Amlogic S905X platform contain an unauthenticated console exposed via an internal UART header on the PCB that allows physical attackers to obtain an interactive shell as uid 2000 system without any credentials. Attackers with physical access and a USB-to-TTL...

EUVD-2026-115401

Nexbox A95X TV boxes built on the Amlogic S905X platform contain an unauthenticated console exposed via an internal UART header on the PCB that allows physical attackers to obtain an interactive shell as uid 2000 system without any credentials. Attackers with physical access and a USB-to-TTL...

CVE-2026-119737 Amlogic pppoe_wrapper Command Injection via AF_UNIX Socket

The pppoewrapper vendor daemon from the Amlogic Android SDK, as shipped on Nexbox A95X Amlogic S905/S905X TV boxes, contains a command injection vulnerability that allows local attackers to execute arbitrary commands as root by sending crafted messages to a world-writable AFUNIX datagram socket a...

EUVD-2026-115546

The pppoewrapper vendor daemon from the Amlogic Android SDK, as shipped on Nexbox A95X Amlogic S905/S905X TV boxes, contains a command injection vulnerability that allows local attackers to execute arbitrary commands as root by sending crafted messages to a world-writable AFUNIX datagram socket a...

CVE-2026-119737

The pppoe_wrapper vendor daemon in the Amlogic Android SDK , specifically on Nexbox A95X (Amlogic S905/S905X) TV boxes, is vulnerable to a command injection flaw. A local attacker can execute arbitrary commands as root by sending crafted messages to a world-writable AF_UNIX datagram socket at /de...

CVE-2026-119737: Nexbox, Amlogic: The pppoe_wrapper vendor daemon from the Amlogic Android SDK, as shipped on Nexbox A95X (Amlogic S905/S905X) TV boxes,…

The pppoewrapper vendor daemon from the Amlogic Android SDK, as shipped on Nexbox A95X Amlogic S905/S905X TV boxes, contains a command injection vulnerability that allows local attackers to execute arbitrary commands as root by sending crafted messages to a world-writable AFUNIX datagram socket a...

CVE-2026-119740: Nexbox A95X: Nexbox A95X TV boxes built on the Amlogic S905X platform contain an unauthenticated console exposed via an internal…

Nexbox A95X TV boxes built on the Amlogic S905X platform contain an unauthenticated console exposed via an internal UART header on the PCB that allows physical attackers to obtain an interactive shell as uid 2000 system without any credentials. Attackers with physical access and a USB-to-TTL...