{"id":"CVE-2026-119740","kind":"vulnerability","aliases":["CVE-2026-119740"],"related":[],"title":"Nexbox A95X TV box: physical UART header gives unauthenticated root shell","description":"Nexbox A95X TV boxes built on the Amlogic S905X platform contain an unauthenticated console exposed via an internal UART header on the PCB that allows physical attackers to obtain an interactive shell as uid 2000 (system) without any credentials. Attackers with physical access and a USB-to-TTL adapter can leverage this shell to reach the pppoe_wrapper vendor daemon, which contains an OS command injection vulnerability executed as root, resulting in full root-level compromise of the device.","summary":"The Nexbox A95X TV box, built on the Amlogic S905X platform, exposes an unauthenticated serial console through an internal UART header on the circuit board. A person with physical access and a USB-to-TTL adapter gets a shell as system user, then can reach a vendor daemon with an OS command injection flaw and gain full root control of the device.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Nexbox A95X","fixed":[],"affected":"<= A7_S905X_v2_2 20160713","ecosystem":"vendor"}],"ecosystems":[],"tags":["amlogic-s905x","infrastructure","iot","nexbox-a95x","physical-access","tv-box"],"not_affected_if":["no-physical-access","other-hardware","physical-access-controlled"],"how_to_check":"Physical: a Nexbox A95X (board A7_S905X_v2.x) with firmware <= A7_S905X_v2_2 20160713 and an accessible UART header (115200 8N1) is affected. On a device with adb shell: ls -la /dev/socket/pppoe_wrapper (world-writable srwxrwxrwx root system) and ls /system/bin/pppoe_wrapper. Also check if you run other Amlogic S905/S905X/S905X3 Android boxes with the same SDK daemon; the researcher saw it in other builds but the advisory lists only the A95X.","fix":"No patched firmware published; none found in the sources. Vendor (Nexbox) page not located.","status":"open","published_at":"2026-11-02T20:17:38+00:00","first_seen_at":"2026-11-02T20:35:26+00:00","triaged_at":"2026-11-02T20:36:34+00:00","updated_at":"2026-11-02T20:37:24+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-02T20:36:34Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Nexbox A95X TV box: physical UART header gives unauthenticated root shell","impact":"high","summary":"The Nexbox A95X TV box, built on the Amlogic S905X platform, exposes an unauthenticated serial console through an internal UART header on the circuit board. A person with physical access and a USB-to-TTL adapter gets a shell as system user, then can reach a vendor daemon with an OS command injection flaw and gain full root control of the device.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["nexbox-a95x","amlogic-s905x","tv-box","iot"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker gains root on the device with physical access","analyst_note":"Check the NVD entry and the VulnCheck advisory for the affected firmware versions, whether a patched firmware exists, and whether the pppoe_wrapper flaw has a separate remote path.","how_to_check":"- Check whether the device is a Nexbox A95X or another Amlogic S905X TV box with an internal UART header\n- Look for a `pppoe_wrapper` process or binary on the device\n- unknown for any other check, as the sources do not say","plain_action":"Keep Nexbox A95X TV boxes out of reach of anyone who could plug a cable into the board, and wait for the vendor to publish a fix.","needs_analyst":true,"not_affected_if":["other-hardware","no-physical-access"],"who_is_affected":"Only the Nexbox A95X TV box on the Amlogic S905X platform is named in the sources. Exploitation needs physical access to the circuit board, a USB-to-TTL adapter, and no credentials. Devices in locked enclosures or in places no one can reach physically are much less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000757,"input_tokens":4219,"output_tokens":671,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the VulnCheck advisory for the affected firmware versions, whether a patched firmware exists, and whether the pppoe_wrapper flaw has a separate remote path.","search":"'-119740':14A,17A '-2026':13A,16A '2000':131C 'a95x':2A,19A,27B,36B,98C 'access':30B,63B,139C 'adapt':70B,146C 'allow':121C 'amlog':21B,42B,104C 'amlogic-s905x':20B 'attack':123C,136C 'board':58B 'box':4A,33B,38B,100C 'built':39B,101C 'circuit':57B 'command':86B,162C 'compromis':174C 'consol':49B,110C 'contain':107C,159C 'control':93B 'credenti':135C 'cve':12A,15A 'daemon':82B,157C 'devic':96B,177C 'execut':165C 'expos':45B,111C 'flaw':88B 'full':91B,170C 'gain':90B 'get':71B 'give':8A 'header':7A,54B,116C 'infrastructur':23B 'inject':87B,163C 'interact':127C 'intern':52B,114C 'iot':24B 'level':173C 'leverag':148C 'nexbox':1A,18A,26B,35B,97C 'nexbox-a95x':25B 'obtain':125C 'os':85B,161C 'pcb':119C 'person':60B 'physic':5A,29B,62B,122C,138C 'physical-access':28B 'platform':44B,106C 'pppoe':154C 'reach':79B,152C 'result':168C 'root':10A,92B,167C,172C 'root-level':171C 's905x':22B,43B,105C 'serial':48B 'shell':11A,73B,128C,150C 'system':75B,132C 'ttl':69B,145C 'tv':3A,32B,37B,99C 'tv-box':31B 'uart':6A,53B,115C 'uid':130C 'unauthent':9A,47B,109C 'usb':67B,143C 'usb-to-ttl':66B,142C 'user':76B 'vendor':81B,156C 'via':112C 'vulner':164C 'without':133C 'wrapper':155C","nicknames":[],"mitigations":[],"who_affected":"Nexbox A95X TV boxes (Amlogic S905X) up to A7_S905X_v2_2 20160713 per VulnCheck. Exploitation needs physical access to open the box and attach a USB-to-TTL adapter, which gives a uid 2000 shell; the pppoe_wrapper command injection then lifts that to root, and any local process can reach it. Shared or public-facing boxes (hotels, kiosks, signage, resale) matter most; home users who control physical access can mostly skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"everyone","plain_action":"Keep Nexbox A95X TV boxes out of reach of anyone who could plug a cable into the board, and wait for the vendor to publish a fix.","pkeys":["a95x","nexboxa95x"],"ptokens":["a95x","nexbox"],"labels":["amlogics905x","high","infrastructure","iot","nexboxa95x","physicalaccess","tvbox"],"first_public_at":"2026-11-02T20:17:38+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-119740","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119740","severity":null,"published_at":"2026-11-02T20:17:38+00:00","modified_at":"2026-11-02T20:17:38+00:00","first_seen_at":"2026-11-02T20:35:26+00:00","fetched_at":"2026-11-02T20:35:26+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119740:1420","url":null,"severity":null,"published_at":"2026-11-02T20:37:24+00:00","modified_at":"2026-11-02T20:37:24+00:00","first_seen_at":"2026-11-02T20:37:24+00:00","fetched_at":"2026-11-02T20:37:24+00:00","note":"Read VulnCheck advisory and researcher's blog (Strada, 2026-10-29). Physical UART shell (uid 2000), then local-only AF_UNIX socket /dev/socket/pppoe_wrapper (mode 777) gives root via system(); no remote path found for pppoe_wrapper (remote needs another foothold). Blog shows device was a community build (Aidan's ATV, Android 7.1.2); researcher traced same daemon in 2016 stock A95X firmwares (S905 and S905X) and Amlogic SDK. No vendor advisory or fixed firmware found; nothing marked verified. PoC public in blog. Not seen exploited."}],"documents":[{"id":53709,"url":"https://www.vulncheck.com/advisories/nexbox-a95x-amlogic-s905x-uart-unauthenticated-console-access","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"},{"id":53780,"url":"https://mstreet97.github.io/security-research/vulnerability-disclosure/embedded/cve/2026/10/29/From-UART-to-root-android-version.html","title":"From UART to Root (Android Version): pppoe_wrapper Command Injection - Matteo Strada","kind":"poc","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":53786,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119740","title":"NVD CVE-2026-119740","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}