---
id: "CVE-2026-119737"
kind: "vulnerability"
aliases: ["CVE-2026-119737"]
title: "Nexbox A95X TV boxes: local root via pppoe_wrapper socket injection"
severity: "high"
cvss: 8.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Nexbox A95X", "fixed": [], "affected": "<= NEXBOX-A95X-201606011847, NEXBOX-A95X-AP6330 (per VulnCheck)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["amlogic", "android-tv-boxes", "infrastructure", "local-privilege-escalation", "nexbox-a95x", "root"]
not_affected_if: ["no-pppoe-wrapper", "non-amlogic-hardware"]
published_at: "2026-11-02T20:17:38+00:00"
first_seen_at: "2026-11-02T20:35:26+00:00"
updated_at: "2026-11-02T20:37:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119737", "first_seen_at": "2026-11-02T20:35:26+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-02T20:37:11+00:00"}]
---

# Nexbox A95X TV boxes: local root via pppoe_wrapper socket injection

The pppoe_wrapper daemon in the Amlogic Android SDK, shipped on Nexbox A95X TV boxes, passes messages sent to a world-writable socket unfiltered to a shell. A local attacker can run arbitrary commands as root.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Nexbox A95X affected <= NEXBOX-A95X-201606011847, NEXBOX-A95X-AP6330 (per VulnCheck) fixed ?

## How to check

- On the box (adb shell), run: ls -l /dev/socket/pppoe_wrapper. If it exists with mode srwxrwxrwx owned by root, the vulnerable daemon is running; also check for /system/bin/pppoe_wrapper.
- VulnCheck lists Nexbox A95X builds up to NEXBOX-A95X-201606011847 and NEXBOX-A95X-AP6330. The researcher reproduced it on a community ROM (Aidan's ATV, Android 7.1.2, 2021 SDK build) and found the same code in 2016 stock A95X firmware.
- Also check other Amlogic S905-family boxes for the same socket; they are not confirmed affected.

## Timeline

- 2026-11-02T20:35:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119737
- 2026-11-02T20:37:11+00:00 analyst — Read VulnCheck advisory and researcher write-up (mstreet, 2026-10-29). Tested on Nexbox A95X S905X running community ROM 'Aidan's ATV' (Android 7.1.2), with identical code found in 2016 stock A95X S905 and S905X firmware, so it is Amlogic SDK code. No vendor fix or advisory found. Nothing verified: no vendor page. No exploitation reported; PoC is described in the post.

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/amlogic-pppoe-wrapper-command-injection-via-af-unix-socket
- [describes] From UART to Root (Android Version): pppoe_wrapper Command Injection - Matteo Strada https://mstreet97.github.io/security-research/vulnerability-disclosure/embedded/cve/2026/10/29/From-UART-to-root-android-version.html

## From the sources

The pppoe_wrapper vendor daemon from the Amlogic Android SDK, as shipped on Nexbox A95X (Amlogic S905/S905X) TV boxes, contains a command injection vulnerability that allows local attackers to execute arbitrary commands as root by sending crafted messages to a world-writable AF_UNIX datagram socket at /dev/socket/pppoe_wrapper. Attackers can send a message beginning with 'pppd pty' followed by shell metacharacters and arbitrary commands, which are passed unfiltered to system(3) and executed by /system/bin/sh -c as root, resulting in full privilege escalation.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_