Command Injection Vulnerability in Amlogic Android SDK on Nexbox A95X TV Boxes
CVE-2026-119737

8.5HIGH

Key Information:

Vendor

Nexbox

Status
A95x
Amlogic Android Sdk
Vendor
CVE Published:
2 November 2026

Badges

👾 Exploit Exists

What is CVE-2026-119737?

The pppoe_wrapper daemon in the Amlogic Android SDK, specifically used in Nexbox A95X TV boxes, suffers from a command injection issue. This flaw allows local attackers to craft specific messages and send them to a world-writable socket located at /dev/socket/pppoe_wrapper. By initiating messages that start with 'pppd pty' followed by shell metacharacters and additional commands, attackers can exploit this vulnerability. The crafted input is unfiltered and subsequently executed by the system shell with root privileges, providing attackers full control over the device.

Affected Version(s)

A95X NEXBOX-A95X-201606011847

A95X NEXBOX-A95X-AP6330

Amlogic Android SDK 0

References

https://mstreet97.github.io/security-research/vulnerabili...
technical-descriptionexploit
https://www.vulncheck.com/advisories/amlogic-pppoe-wrappe...
third-party-advisory

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Matteo Strada (mstreet)
.