Live › vulnerability › CVE-2026-119737
The pppoe_wrapper daemon in the Amlogic Android SDK, shipped on Nexbox A95X TV boxes, passes messages sent to a world-writable socket unfiltered to a shell. A local attacker can run arbitrary commands as root.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 20:35 UTC. All times on this page are UTC.
Nexbox A95X (Amlogic S905/S905X) TV boxes whose firmware includes the Amlogic pppoe_wrapper daemon, and per the researcher the 2016 stock builds and a 2021 community ROM build. An attacker needs local code execution on the box (an app, a shell, or the physical serial console) to get root. Other Amlogic boxes may carry the same SDK code but no source confirms them. Boxes without /dev/socket/pppoe_wrapper can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Nexbox A95X | vendor | <= NEXBOX-A95X-201606011847, NEXBOX-A95X-AP6330 (per VulnCheck) | – |
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The pppoe_wrapper vendor daemon from the Amlogic Android SDK, as shipped on Nexbox A95X (Amlogic S905/S905X) TV boxes, contains a command injection vulnerability that allows local attackers to execute arbitrary commands as root by sending crafted messages to a world-writable AF_UNIX datagram socket at /dev/socket/pppoe_wrapper. Attackers can send a message beginning with 'pppd pty' followed by shell metacharacters and arbitrary commands, which are passed unfiltered to system(3) and executed by /system/bin/sh -c as root, resulting in full privilege escalation.
This page as .md · .json · in your agent: get_signal("CVE-2026-119737")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.