EUVD-2026-115401
GHSA-7prp-vrqq-87rq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessOpen enclosure, attach USB-to-TTL to UART header
-
ExploitObtain unauthenticated console shell as uid 2000
-
ExecutionInvoke pppoe_wrapper daemon with injected OS command
-
ImpactCommand executes as root, full device compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires physical access to the device: the attacker must open the enclosure and connect a USB-to-TTL adapter to an internal UART header on the PCB (AV:P). The first-stage console requires no credentials (PR:N) and yields a uid 2000 (system) shell; the second stage requires the pppoe_wrapper vendor daemon to be present so its OS command injection can be invoked to reach root. The dominant limiting factor is physical access - there is no network or local-software path described, so remote or at-scale exploitation is not possible; realistic risk is confined to evil-maid, lost/stolen device, or supply-chain tampering scenarios. |
| Impact | The CVSS 4.0 base score of 7.0 (High) is driven by full compromise impact (VC:H/VI:H/VA:H) rather than ease of access: the vector is AV:P (physical), AC:L, PR:N, UI:N. The decisive mitigating signal is the physical attack vector - exploitation requires opening the enclosure and attaching a USB-to-TTL adapter to an internal UART header, so this is not remotely reachable and cannot be exploited at scale over a network. No EPSS score was provided and the issue is NOT in CISA KEV, so there is no evidence of active or widespread exploitation; the vuln.today decision label is 'this_week' rather than act_now/emergency. A public PoC reference exists but is not verified as working exploit code. Weighing these signals: this is a genuine design flaw (unauthenticated console, CWE-306) that chains to root via the pppoe_wrapper command injection, but the physical-access precondition makes it a targeted/supply-chain or evil-maid concern for individual devices, not a mass-exploitation priority. PR:N here reflects that the console needs no credentials - the real gate is physical access captured by AV:P, which should not be mistaken for low difficulty of remote attack. |
| Exploit ScenarioDerived | An attacker with physical possession of a Nexbox A95X box opens the case and connects a USB-to-TTL adapter to the exposed UART header on the PCB, receiving an interactive shell as uid 2000 (system) with no credentials. From that shell they invoke the pppoe_wrapper vendor daemon, whose OS command injection runs as root, yielding full root compromise of the device. A public PoC reference describing the Android-version path exists but is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 02, 2026
Physical access to a Nexbox A95X TV box built on the Amlogic S905X platform lets an attacker attach a USB-to-TTL adapter to an internal UART header and obtain a passwordless uid 2000 (system) shell; from there the pppoe_wrapper vendor daemon's OS command injection can be used to gain root, resulting in full device compromise. The issue is rated CVSS 4.0 7.0 (High) and independently assessed as CVSS 3.1 AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, with physical access as the dominant limiting factor rather than exploitation complexity. No CISA KEV listing is present, a public PoC reference exists but is not verified as working exploit code, and vuln.today prioritizes the issue as this_week.
RemediationAI
No vendor-released patch was identified at time of analysis, so remediation is primarily physical and configuration-based. Restrict physical access to deployed A95X units and use tamper-evident seals or locked enclosures; this reduces evil-maid and lost or stolen device risk but does not fix the underlying firmware. If the device is not required to act as a PPPoE client, disable or remove the pppoe_wrapper daemon so the root escalation path is unavailable, verifying first that no legitimate PPPoE function depends on it, since removing it breaks that capability. Where hardware modification is acceptable, physically blocking or removing the UART header pads or disabling the serial console in the bootloader or firmware removes the first-stage shell, at the cost of voiding warranties, requiring custom firmware work, and risking bricking the device. Treat devices with unexplained tampering as compromised and reflash or replace them; the two references above are the available vendor and researcher documentation.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The A95X is an Android TV box using Amlogic's S905X SoC. Its PCB exposes an internal UART header wired to a serial console that presents an interactive shell without any credential prompt, which is the CWE-306 (missing authentication for critical function) condition described. The shell runs as uid 2000 (system) rather than root, but the vendor's pppoe_wrapper daemon is reachable from it and contains an OS command injection that executes as root, chaining the two weaknesses into full compromise. The available sources do not describe how the pppoe_wrapper injection is triggered beyond the daemon being reachable from the UART shell, and the CPE cpe:2.3:a:nexbox:a95x:*:*:*:*:*:*:*:* does not pin a firmware version. The CVSS metrics describe severity and prerequisites (AV:P/AC:L/PR:N/UI:N, C:H/I:H/A:H) rather than the mechanism; the practical constraint is that the attacker must open the enclosure and physically connect to the header.
Know when A95X gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Physical UART header access gives AV:P; the console needs no credentials so PR:N; the chained pppoe_wrapper injection runs as root, so C/I/A are all High.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Nexbox A95X TV boxes built on the Amlogic S905X platform contain an unauthenticated console exposed via an internal UART header on the PCB that allows physical attackers to obtain an interactive shell as uid 2000 (system) without any credentials. Attackers with physical access and a USB-to-TTL adapter can leverage this shell to reach the pppoe_wrapper vendor daemon, which contains an OS command injection vulnerability executed as root, resulting in full root-level compromise of the device.
Articles & Coverage 2
Technical POC Analysis
Two defects chained; the CVE is filed against the first, the impact text describes the second.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
A high-severity vulnerability in the Nexbox A95X TV box (Amlogic S905X) allows an attacker with physical access to connect to an internal UART header and obtain a passwordless system shell, then escalate to root via a command injection in the pppoe_wrapper daemon, resulting in full device compromise. While exploitation requires direct device access, the potential for data exfiltration or device repurposing is significant for organizations with these devices in public or shared spaces, and leadership should assess the risk to their deployed assets.
Enforce strict physical access controls (locked enclosures, restricted areas), disable the pppoe_wrapper daemon if not required, and segment affected devices on isolated network segments; monitor for unauthorized USB connections.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Local privilege escalation to root affects the Amlogic Android SDK's pppoe_wrapper daemon as shipped on Nexbox A95X (Aml
An out-of-bounds stack write in the VobSub subtitle decoder (libsub_vob) of the Amlogic DroidLogic SubTitleService allow
An infinite loop in the get_vob_spu() function of the libsub_vob VobSub subtitle decoder, part of Amlogic's DroidLogic S
Exploit-DB