---
id: "CVE-2026-119740"
kind: "vulnerability"
aliases: ["CVE-2026-119740"]
title: "Nexbox A95X TV box: physical UART header gives unauthenticated root shell"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Nexbox A95X", "fixed": [], "affected": "<= A7_S905X_v2_2 20160713", "ecosystem": "vendor"}]
ecosystems: []
tags: ["amlogic-s905x", "infrastructure", "iot", "nexbox-a95x", "physical-access", "tv-box"]
not_affected_if: ["no-physical-access", "other-hardware", "physical-access-controlled"]
published_at: "2026-11-02T20:17:38+00:00"
first_seen_at: "2026-11-02T20:35:26+00:00"
updated_at: "2026-11-02T20:37:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119740", "first_seen_at": "2026-11-02T20:35:26+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-02T20:37:24+00:00"}]
---

# Nexbox A95X TV box: physical UART header gives unauthenticated root shell

The Nexbox A95X TV box, built on the Amlogic S905X platform, exposes an unauthenticated serial console through an internal UART header on the circuit board. A person with physical access and a USB-to-TTL adapter gets a shell as system user, then can reach a vendor daemon with an OS command injection flaw and gain full root control of the device.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Nexbox A95X affected <= A7_S905X_v2_2 20160713 fixed ?

## How to check

Physical: a Nexbox A95X (board A7_S905X_v2.x) with firmware <= A7_S905X_v2_2 20160713 and an accessible UART header (115200 8N1) is affected. On a device with adb shell: ls -la /dev/socket/pppoe_wrapper (world-writable srwxrwxrwx root system) and ls /system/bin/pppoe_wrapper. Also check if you run other Amlogic S905/S905X/S905X3 Android boxes with the same SDK daemon; the researcher saw it in other builds but the advisory lists only the A95X.

## Fix

No patched firmware published; none found in the sources. Vendor (Nexbox) page not located.

## Timeline

- 2026-11-02T20:35:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119740
- 2026-11-02T20:37:24+00:00 analyst — Read VulnCheck advisory and researcher's blog (Strada, 2026-10-29). Physical UART shell (uid 2000), then local-only AF_UNIX socket /dev/socket/pppoe_wrapper (mode 777) gives root via system(); no remote path found for pppoe_wrapper (remote needs another foothold). Blog shows device was a community build (Aidan's ATV, Android 7.1.2); researcher traced same daemon in 2016 stock A95X firmwares (S905 and S905X) and Amlogic SDK. No vendor advisory or fixed firmware found; nothing marked verified. PoC public in blog. Not seen exploited.

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/nexbox-a95x-amlogic-s905x-uart-unauthenticated-console-access
- [mentions] NVD CVE-2026-119740 https://nvd.nist.gov/vuln/detail/CVE-2026-119740
- [poc] From UART to Root (Android Version): pppoe_wrapper Command Injection - Matteo Strada https://mstreet97.github.io/security-research/vulnerability-disclosure/embedded/cve/2026/10/29/From-UART-to-root-android-version.html

## From the sources

Nexbox A95X TV boxes built on the Amlogic S905X platform contain an unauthenticated console exposed via an internal UART header on the PCB that allows physical attackers to obtain an interactive shell as uid 2000 (system) without any credentials. Attackers with physical access and a USB-to-TTL adapter can leverage this shell to reach the pppoe_wrapper vendor daemon, which contains an OS command injection vulnerability executed as root, resulting in full root-level compromise of the device.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_