Code 27 3D Companion Hub Recovery Mode ADB Root Privilege Escalation (CVE-2026-36027)

Code 27 3D Companion Hub Vulnerabilities (CVE-2026-36027, CVE-2026-36028) Vulnerability Overview Code 27 3D Companion Hub is a physical desktop device that renders a custom AI character ("Codie") as an animated 3D companion. Users can upload or create any 3D model, with multimodal AI enabling the character to perceive its surroundings, read tone and body language, and engage in open-ended dialogue. This report covers two vulnerabilities requiring physical access to the device. Both were verified against the shipped build and were unpatched at the time of publication. Affected Device/Build The shipped firmware is a build (visible in the recovery banner and ). A build allows to restart as root via , which is a key enabler for CVE-2026-36027. CVE-2026-36027 - Arbitrary Code Execution via USB Debugging (ADB) in Recovery Executive Summary An attacker in physical proximity can boot the Companion Hub into Android Recovery mode and obtain a root-privileged ADB shell (with SELinux context ). Because the device ships as a build, can restart with root privileges, granting the attacker read-only interactive access to the recovery environment. This allows enumeration of build and hardware properties, as well as access to recovery features (sideload, fastboot, partition operations). The obtained access is limited to the recovery ramdisk and does not extend to the live Android runtime. During testing, the recovery command failed ( could not open ), meaning the system partition was not mounted directly via this path. Consequently, the booted user environment, the kiosk mode, and any decrypted user data are not visible in this mode. This remains significant because root access in recovery mode serves as the foundation for modifying persistent device state (e.g., writing to partitions or applying custom update packages). This allows attacker-controlled code to execute during subsequent normal boots, establishing a foothold on the live device. Proof of Concept 1. Power off the device. 2. Once the device is fully off, hold the Power and Volume buttons simultaneously until the Android Recovery menu appears. 3. Connect a USB-C cable from the Companion Hub to the USB-A port of a computer. 4. Use the buttons to navigate to , highlight it, and confirm. It will show failure. This is expected; the exploit still works. (The recovery log shows could not open .) 5. Install ADB on the computer and verify the device is listed: 6. The device is in recovery mode. Restart with root context: 7. Open a shell - you are now root of the device: 8. Using the root shell, you can enumerate and interact with the recovery filesystem: CVE-2026-36028 - Arbitrary Code Execution via USB Debugging (ADB) in Recovery Executive Summary Executing a factory reset from the recovery menu erases the partition, where the kiosk application is installed. Since the kiosk app is not part of the system partition, it does not restore upon reboot, and the device boots into a standard, unrestricted Android environment (launcher, web browser, file manager, settings, and other system applications). From this unrestricted environment, an attacker can re-enable Developer Options/USB Debugging, sideload any arbitrary APK, and execute it to obtain a shell for the live operating system. During testing, this resulted in a Meterpreter session running as an unprivileged application user . This differs from the recovery mode root access in CVE-2026-36027 because it runs on the live boot OS, not the recovery ramdisk. Code implantation and execution in this state, as part of normal device operation, grant the attacker interactive control over the device and its user-accessible filesystem. Proof of Concept 1. Power off the device. 2. Once the device is fully off, hold the Power and Volume buttons simultaneously until the Android Recovery menu appears. 3. Highlight and confirm the erase. 4. Upon reboot, the kiosk application is missing, and kiosk mode does not start. This is because the kiosk application is installed on the partition rather than the system partition. Factory reset via recovery erases , permanently deleting the kiosk application; since they are not in the system partition, they do not restore upon reboot, and the kiosk fails to launch. 5. The attacker faces an unrestricted Android environment, including web browsers, file managers, settings, and other system applications. From here, USB Debugging can be enabled, and arbitrary APKs can be sideloaded and executed - in this case, generating a Meterpreter session on the live OS: ``` [] Sensing stage (72424 bytes) to 10.0.8.48 [] Meterpreter session 2 opened (10.0.0.224:49000 -> 10.0.0.48:58094) at 2026-02-20 19:06:47 -0500 meterpreter > getuid Server username: u0_a79 meterpreter > cd / meterpreter > ls Listing: / ================= Mode Size Type Last modified Name ---- ---- ---- ------------- ---- 040554/r-xr-xr-x 4096 dir 2008-12-31 19:00:03 -0500 acct 040554/r-xr-xr-x 480 dir 1969-12-31 19:00:03 -0500 apex 040110/r--x--x--

Goal Reached Thanks to every supporter — we hit 100%!

Code 27 3D Companion Hub Recovery Mode ADB Root Privilege Escalation (CVE-2026-36027)

More from this source