Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-119740— Nexbox A95X Amlogic S905X UART Unauthenticated Console Access

Quick assessment

Affected
Nexbox A95X
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

基于 Amlogic S905X 平台构建的 Nexbox A95X 电视盒子，其 PCB 板上存在一个通过内部 UART 接口暴露的未认证控制台。该漏洞允许拥有物理访问权限的攻击者无需任何凭证即可获得一个以 uid 2000（system）身份运行的交互式 Shell。攻击者若具备物理访问条件并配备 USB 转 TTL 适配器，可利用该 Shell 访问名为 的厂商守护进程。该守护进程存在操作系统命令注入漏洞，且以 root 权限执行，最终可导致攻击者完全获取设备的 root 控制权。

CVSS 6.8 · Medium EPSS 0.79% · P56

Affected Version Matrix 1

VendorProduct Version RangeStatus
Nexbox A95X A7_S905X_v2_2 20160713 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-119740

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Nexbox A95X Amlogic S905X UART Unauthenticated Console Access
Source: CVE Program / CVE List V5
Vulnerability Description
Nexbox A95X TV boxes built on the Amlogic S905X platform contain an unauthenticated console exposed via an internal UART header on the PCB that allows physical attackers to obtain an interactive shell as uid 2000 (system) without any credentials. Attackers with physical access and a USB-to-TTL adapter can leverage this shell to reach the pppoe_wrapper vendor daemon, which contains an OS command injection vulnerability executed as root, resulting in full root-level compromise of the device.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Nexbox A95X A7_S905X_v2_2 20160713 -

II. Public POCs for CVE-2026-119740

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-119740

请登录查看更多情报信息。

Other References for CVE-2026-119740 (2)

Same Patch Batch · Nexbox · 2026-11-02 · 4 CVEs total

CVE-2026-119737 7.8 HIGH Amlogic pppoe_wrapper Command Injection via AF_UNIX Socket
CVE-2026-119739 5.3 MEDIUM Amlogic DroidLogic SubTitleService Out-of-Bounds Write via VobSub SET_CONTR
CVE-2026-119738 5.3 MEDIUM Amlogic DroidLogic SubTitleService Infinite Loop via get_vob_spu()

IV. Related Vulnerabilities

Same product: A95X
Same vendor: Nexbox
Same weakness: CWE-306