{"id":"CVE-2026-119737","kind":"vulnerability","aliases":["CVE-2026-119737"],"related":[],"title":"Nexbox A95X TV boxes: local root via pppoe_wrapper socket injection","description":"The pppoe_wrapper vendor daemon from the Amlogic Android SDK, as shipped on Nexbox A95X (Amlogic S905/S905X) TV boxes, contains a command injection vulnerability that allows local attackers to execute arbitrary commands as root by sending crafted messages to a world-writable AF_UNIX datagram socket at /dev/socket/pppoe_wrapper. Attackers can send a message beginning with 'pppd pty' followed by shell metacharacters and arbitrary commands, which are passed unfiltered to system(3) and executed by /system/bin/sh -c as root, resulting in full privilege escalation.","summary":"The pppoe_wrapper daemon in the Amlogic Android SDK, shipped on Nexbox A95X TV boxes, passes messages sent to a world-writable socket unfiltered to a shell. A local attacker can run arbitrary commands as root.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Nexbox A95X","fixed":[],"affected":"<= NEXBOX-A95X-201606011847, NEXBOX-A95X-AP6330 (per VulnCheck)","ecosystem":"vendor"}],"ecosystems":[],"tags":["amlogic","android-tv-boxes","infrastructure","local-privilege-escalation","nexbox-a95x","root"],"not_affected_if":["no-pppoe-wrapper","non-amlogic-hardware"],"how_to_check":"- On the box (adb shell), run: ls -l /dev/socket/pppoe_wrapper. If it exists with mode srwxrwxrwx owned by root, the vulnerable daemon is running; also check for /system/bin/pppoe_wrapper.\n- VulnCheck lists Nexbox A95X builds up to NEXBOX-A95X-201606011847 and NEXBOX-A95X-AP6330. The researcher reproduced it on a community ROM (Aidan's ATV, Android 7.1.2, 2021 SDK build) and found the same code in 2016 stock A95X firmware.\n- Also check other Amlogic S905-family boxes for the same socket; they are not confirmed affected.","fix":null,"status":"open","published_at":"2026-11-02T20:17:38+00:00","first_seen_at":"2026-11-02T20:35:26+00:00","triaged_at":"2026-11-02T20:36:28+00:00","updated_at":"2026-11-02T20:37:11+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-02T20:36:28Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Nexbox A95X TV boxes: local root via pppoe_wrapper socket injection","impact":"high","summary":"The pppoe_wrapper daemon in the Amlogic Android SDK, shipped on Nexbox A95X TV boxes, passes messages sent to a world-writable socket unfiltered to a shell. A local attacker can run arbitrary commands as root.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["nexbox-a95x","amlogic","android-tv-boxes"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker gains root on the device through a local socket message","analyst_note":"Find the vendor or Nexbox firmware fix and the affected build range; check the VulnCheck advisory linked in the sources.","how_to_check":"- Check whether the device runs the Amlogic Android SDK build with the pppoe_wrapper daemon, for example by looking for `/dev/socket/pppoe_wrapper`\n- Check the device model: unknown if the sources do not say beyond the Nexbox A95X (Amlogic S905/S905X) named","plain_action":"If you own a Nexbox A95X TV box, check with its maker for a firmware update that fixes this, since the sources give no fixed version.","needs_analyst":true,"not_affected_if":["no-pppoe-wrapper","non-amlogic-hardware"],"who_is_affected":"Only devices running the Amlogic Android SDK build of pppoe_wrapper, as shipped on Nexbox A95X (Amlogic S905/S905X) TV boxes. The attacker must already have local code execution on the device, since the socket is only reachable on the machine. Systems without this vendor daemon are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000759,"input_tokens":4283,"output_tokens":661,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor or Nexbox firmware fix and the affected build range; check the VulnCheck advisory linked in the sources.","search":"'-119737':14A,17A '-2026':13A,16A '/dev/socket/pppoe_wrapper':119C '/system/bin/sh':146C '3':142C 'a95x':2A,19A,32B,46B,85C 'af':114C 'allow':96C 'amlog':20B,40B,78C,86C 'android':22B,41B,79C 'android-tv-box':21B 'arbitrari':67B,101C,134C 'attack':64B,98C,120C 'begin':125C 'box':4A,24B,48B,89C 'c':147C 'command':68B,92C,102C,135C 'contain':90C 'craft':107C 'cve':12A,15A 'daemon':37B,75C 'datagram':116C 'escal':29B,154C 'execut':100C,144C 'follow':129C 'full':152C 'infrastructur':25B 'inject':11A,93C 'local':5A,27B,63B,97C 'local-privilege-escal':26B 'messag':50B,108C,124C 'metacharact':132C 'nexbox':1A,18A,31B,45B,84C 'nexbox-a95x':30B 'pass':49B,138C 'pppd':127C 'pppoe':8A,35B,72C 'privileg':28B,153C 'pti':128C 'result':150C 'root':6A,33B,70B,104C,149C 'run':66B 's905/s905x':87C 'sdk':42B,80C 'send':106C,122C 'sent':51B 'shell':61B,131C 'ship':43B,82C 'socket':10A,57B,117C 'system':141C 'tv':3A,23B,47B,88C 'unfilt':58B,139C 'unix':115C 'vendor':74C 'via':7A 'vulner':94C 'world':55B,112C 'world-writ':54B,111C 'wrapper':9A,36B,73C 'writabl':56B,113C","nicknames":[],"mitigations":[],"who_affected":"Nexbox A95X (Amlogic S905/S905X) TV boxes whose firmware includes the Amlogic pppoe_wrapper daemon, and per the researcher the 2016 stock builds and a 2021 community ROM build. An attacker needs local code execution on the box (an app, a shell, or the physical serial console) to get root. Other Amlogic boxes may carry the same SDK code but no source confirms them. Boxes without /dev/socket/pppoe_wrapper can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":"If you own a Nexbox A95X TV box, check with its maker for a firmware update that fixes this, since the sources give no fixed version.","pkeys":["a95x","nexboxa95x"],"ptokens":["a95x","nexbox"],"labels":["amlogic","androidtvboxes","high","infrastructure","localprivilegeescalation","nexboxa95x","root"],"first_public_at":"2026-11-02T20:17:38+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119737","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119737","severity":null,"published_at":"2026-11-02T20:17:38+00:00","modified_at":"2026-11-02T20:17:38+00:00","first_seen_at":"2026-11-02T20:35:26+00:00","fetched_at":"2026-11-02T20:35:26+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119737:1421","url":null,"severity":null,"published_at":"2026-11-02T20:37:11+00:00","modified_at":"2026-11-02T20:37:11+00:00","first_seen_at":"2026-11-02T20:37:11+00:00","fetched_at":"2026-11-02T20:37:11+00:00","note":"Read VulnCheck advisory and researcher write-up (mstreet, 2026-10-29). Tested on Nexbox A95X S905X running community ROM 'Aidan's ATV' (Android 7.1.2), with identical code found in 2016 stock A95X S905 and S905X firmware, so it is Amlogic SDK code. No vendor fix or advisory found. Nothing verified: no vendor page. No exploitation reported; PoC is described in the post."}],"documents":[{"id":53703,"url":"https://www.vulncheck.com/advisories/amlogic-pppoe-wrapper-command-injection-via-af-unix-socket","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"},{"id":53780,"url":"https://mstreet97.github.io/security-research/vulnerability-disclosure/embedded/cve/2026/10/29/From-UART-to-root-android-version.html","title":"From UART to Root (Android Version): pppoe_wrapper Command Injection - Matteo Strada","kind":"poc","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}