Which versions of TV98 TV Box are affected by CVE-2026-58378?

The Allwinner H616-based TV98 Android TV Box ships with a remotely accessible debug interface (ADB) enabled by default, allowing network attackers to obtain root-level control of the device once a…

How to fix or mitigate CVE-2026-58378?

Within 24 hours: inventory all TV98 devices in production and implement firewall rules to block inbound connections to TCP 5555; if feasible, disable ADB through device settings or network segmentation. Within 7 days: contact Allwinner and TV98 vendor for patch availability timeline and evaluate expedited replacement options. Within 30 days: apply vendor-released patch immediately upon release or complete replacement of affected devices with patched units.

TV98 TV Box CVE-2026-58378

Q: What is the CVSS score of CVE-2026-58378?

CVE-2026-58378 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-42661 HIGH

Active Debug Code (CWE-489)

2026-07-09 9119a7d8-5eab-497f-8521-727c672e3725

GHSA-mfgm-xvxw-j43w

Information Disclosure

8.6

CVSS 4.0 · Vendor: 9119a7d8-5eab-497f-8521-727c672e3725

Severity by source

Vendor (9119a7d8-5eab-497f-8521-727c672e3725) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable adbd with no attacker auth (PR:N) but victim must approve the prompt (UI:R); success yields root, so C/I/A all High and scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (9119a7d8-5eab-497f-8521-727c672e3725).

CVSS VectorVendor: 9119a7d8-5eab-497f-8521-727c672e3725

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 18:33 vuln.today

DescriptionCVE.org

Allwinner H616 TV Box TV98 has ADB enabled and exposed to the network on production. An attacker could request for ADB authorization and gain root level privileges if the victim allows access.

AnalysisAI

Root-level device takeover affects the Allwinner H616-based TV98 Android TV Box, which ships to production with the Android Debug Bridge (ADB) daemon enabled and reachable over the network (TCP/5555). A network attacker can send an ADB authorization request, and if the victim accepts the RSA key confirmation prompt on the device, the attacker obtains a root shell. Classified under CWE-489 (leftover debug functionality), there is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the attack is trivial once a user approves the pairing.

Technical ContextAI

The affected component is Android's Debug Bridge (ADB), a developer/debug facility normally bound to USB or localhost and disabled on retail firmware. On this device it is left listening on the network interface, exposing the adbd service (typically TCP port 5555). This is a textbook CWE-489 'Active Debug Code' / leftover-debug issue: shipping firmware retains a debug capability meant only for development. Because adbd on many low-cost Android TV boxes runs as root (rather than the restricted 'shell' user), a successful ADB connection yields root rather than an unprivileged shell. The platform is the Allwinner H616 SoC, a quad-core Cortex-A53 chip widely used in inexpensive Android/Android-TV set-top boxes; the specific product is the TV98 box built on that SoC.

RemediationAI

No vendor-released patch version was identified at time of analysis; consult the CSAF advisory (https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-190-03.json) for vendor firmware guidance. As the primary compensating control, disable network ADB on the device: in Android settings turn off 'Developer options' / 'USB debugging' / 'ADB over network', or from a trusted shell run 'setprop persist.adb.tcp.port -1' and 'stop adbd' so adbd no longer binds to the network - trade-off is loss of remote debugging capability, which is acceptable on a production box. At the network layer, block or firewall inbound TCP/5555 (and adjacent ADB ports) at the router/gateway and place the device on an isolated IoT VLAN with no inbound reachability - trade-off is that legitimate remote management over ADB also breaks. Critically, instruct users never to approve the ADB authorization / RSA key prompt from unknown sources, since UI:A means the attack fails without that approval.