CVE-2026-119740
Received Received - Intake

Unauthenticated Console OS Command Injection in Nexbox A95X TV Boxes

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: VulnCheck

Description
Nexbox A95X TV boxes built on the Amlogic S905X platform contain an unauthenticated console exposed via an internal UART header on the PCB that allows physical attackers to obtain an interactive shell as uid 2000 (system) without any credentials. Attackers with physical access and a USB-to-TTL adapter can leverage this shell to reach the pppoe_wrapper vendor daemon, which contains an OS command injection vulnerability executed as root, resulting in full root-level compromise of the device.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-119740

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Nexbox A95X A7_S905X_v2_2 20160713

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Nexbox A95X TV boxes built on the Amlogic S905X platform. It allows physical attackers with a USB-to-TTL adapter to access an unauthenticated console via an internal UART header on the PCB. This grants an interactive shell as uid 2000 (system) without credentials. From there, attackers can exploit an OS command injection flaw in the pppoe_wrapper vendor daemon, which runs as root, leading to full root-level compromise of the device.

Detection Guidance

This vulnerability requires physical access to the device via the internal UART header. It cannot be detected remotely through network commands. Inspect the PCB for an unpopulated UART header near the Amlogic S905X chip. If present, connect a USB-to-TTL adapter to check for an exposed console shell.

Impact Analysis

If you own a Nexbox A95X TV box, an attacker with physical access could gain full control over your device. This could allow them to install malware, steal data, or use your device as part of a botnet. Even without direct access, the risk exists if someone gains physical entry to your device.

Mitigation Strategies

Disable physical access to the device by sealing the UART header with epoxy or removing it. Update the firmware to the latest version if available. Ensure the device is not accessible to unauthorized personnel. Monitor for unusual root-level activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119740. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...