Amlogic Android SDK EUVD-2026-115546

Requires local presence on the device with the ability to write to the AF_UNIX datagram socket at /dev/socket/pppoe_wrapper; because that socket is world-writable, any unprivileged local process or app can reach it with no additional authentication (PR:L) and no user interaction (UI:N). The daemon is present as shipped, so no non-default configuration is needed. The decisive limiting factor is AV:L: the attacker must already have local code execution on an affected device (e.g. a malicious/sideloaded app or an existing low-privilege shell) - there is no network-reachable path. Exploitation is constrained to devices that ship the Amlogic pppoe_wrapper daemon, specifically Nexbox A95X (Amlogic S905/S905X) TV boxes and other builds derived from the affected Amlogic Android SDK.

The CVSS 4.0 base score of 8.5 reflects complete compromise of the vulnerable system (VC:H/VI:H/VA:H), but the single most important mitigating signal is AV:L - this is a LOCAL-only privilege escalation, not a remotely reachable flaw, so it cannot be exploited across a network and does not enable mass or wormable exploitation. PR:L and AC:L indicate that once an attacker has any unprivileged local foothold (e.g. a malicious or compromised app) the escalation to root is trivial and reliable, since the socket is world-writable and the input is passed unfiltered to system(3). No EPSS score is provided and the CVE is not listed in CISA KEV, so there is no evidence of active or widespread exploitation; a public PoC reference exists (a UART-to-root disclosure writeup) but it is not verified as working exploit code. The vuln.today decision label is 'this_week', consistent with a serious but access-gated local flaw rather than an internet-facing emergency. Net assessment: a genuine, high-impact root escalation that should be prioritized this week for owners of affected devices, but its real-world risk is bounded by the requirement for pre-existing local access and the niche consumer hardware footprint - it is not a high-CVSS-but-trivial issue, yet neither is it a remotely exploitable crisis.

A malicious or compromised unprivileged app on a Nexbox A95X TV box opens the world-writable AF_UNIX datagram socket at /dev/socket/pppoe_wrapper and sends a crafted datagram beginning with 'pppd pty' followed by shell metacharacters and attacker commands. The root-owned pppoe_wrapper daemon passes the string unfiltered to system(3), which runs it via /system/bin/sh -c as root, yielding full device compromise. A public PoC reference exists but is not verified as working exploit code; with AV:L/AC:L the technique is straightforward once any local execution context is obtained.