Live › vulnerability › CVE-2026-119740
The Nexbox A95X TV box, built on the Amlogic S905X platform, exposes an unauthenticated serial console through an internal UART header on the circuit board. A person with physical access and a USB-to-TTL adapter gets a shell as system user, then can reach a vendor daemon with an OS command injection flaw and gain full root control of the device.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 20:35 UTC. All times on this page are UTC.
Nexbox A95X TV boxes (Amlogic S905X) up to A7_S905X_v2_2 20160713 per VulnCheck. Exploitation needs physical access to open the box and attach a USB-to-TTL adapter, which gives a uid 2000 shell; the pppoe_wrapper command injection then lifts that to root, and any local process can reach it. Shared or public-facing boxes (hotels, kiosks, signage, resale) matter most; home users who control physical access can mostly skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Nexbox A95X | vendor | <= A7_S905X_v2_2 20160713 | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Nexbox A95X TV boxes built on the Amlogic S905X platform contain an unauthenticated console exposed via an internal UART header on the PCB that allows physical attackers to obtain an interactive shell as uid 2000 (system) without any credentials. Attackers with physical access and a USB-to-TTL adapter can leverage this shell to reach the pppoe_wrapper vendor daemon, which contains an OS command injection vulnerability executed as root, resulting in full root-level compromise of the device.
This page as .md · .json · in your agent: get_signal("CVE-2026-119740")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.