A95X
Monthly
Physical access to a Nexbox A95X TV box built on the Amlogic S905X platform lets an attacker attach a USB-to-TTL adapter to an internal UART header and obtain a passwordless uid 2000 (system) shell; from there the pppoe_wrapper vendor daemon's OS command injection can be used to gain root, resulting in full device compromise. The issue is rated CVSS 4.0 7.0 (High) and independently assessed as CVSS 3.1 AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, with physical access as the dominant limiting factor rather than exploitation complexity. No CISA KEV listing is present, a public PoC reference exists but is not verified as working exploit code, and vuln.today prioritizes the issue as this_week.
Local privilege escalation to root affects the Amlogic Android SDK's pppoe_wrapper daemon as shipped on Nexbox A95X (Amlogic S905/S905X) TV boxes, where any unprivileged local process or app can send a crafted message to the world-writable AF_UNIX datagram socket at /dev/socket/pppoe_wrapper. A message beginning with 'pppd pty' and containing shell metacharacters is passed unfiltered to system(3) and executed by /system/bin/sh -c as root, giving full control of the device. Exploitation is local-only (CVSS 4.0 AV:L, independently assessed CVSS 3.1 AV:L/AC:L/PR:L/UI:N) and requires the attacker to already have local code execution; a public PoC reference exists but is not verified as working exploit code, and no CISA KEV active-exploitation entry is present.
An out-of-bounds stack write in the VobSub subtitle decoder (libsub_vob) of the Amlogic DroidLogic SubTitleService allows remote attackers to corrupt memory on Nexbox A95X (Amlogic S905X) TV boxes and other devices built from the Amlogic Android SDK. A crafted SET_CONTR command carrying an attacker-controlled alpha value drives the change_data index past the end of the fixed four-element PixelDatas array inside vob_fill_pixel(), zeroing adjacent stack bytes; the payload can arrive over the unauthenticated tcp/10100 socket or by getting the device to parse a malicious .sub file. No authentication and no user interaction are required, but the assessed impact is limited to silent stack corruption or a process crash rather than code execution, and the tcp/10100 service is typically LAN-exposed rather than internet-facing. A public PoC reference exists; it is not verified as working exploit code, and no confirmed active exploitation has been reported.
An infinite loop in the get_vob_spu() function of the libsub_vob VobSub subtitle decoder, part of Amlogic's DroidLogic SubTitleService shipped on Amlogic S905X-based devices such as the Nexbox A95X TV box, lets remote network attackers reachable on the LAN or local users loading a crafted file stall the subtitle decode thread at 100% CPU indefinitely, producing a denial of service. Two trigger paths are documented: sending a crafted AMLU data block with mismatched length fields to the unauthenticated tcp/10100 listener, or loading a malicious VobSub (.sub) file. No authentication or user interaction is required (CVSS 4.0 base 6.9 Medium; assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N with availability-only low impact), and only a public PoC reference exists - it is not verified as working exploit code, and no active exploitation has been confirmed. Exposure is bounded by the fact that tcp/10100 is a local service typically reachable only from the LAN, with no confidentiality or integrity impact and no code execution.
Physical access to a Nexbox A95X TV box built on the Amlogic S905X platform lets an attacker attach a USB-to-TTL adapter to an internal UART header and obtain a passwordless uid 2000 (system) shell; from there the pppoe_wrapper vendor daemon's OS command injection can be used to gain root, resulting in full device compromise. The issue is rated CVSS 4.0 7.0 (High) and independently assessed as CVSS 3.1 AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, with physical access as the dominant limiting factor rather than exploitation complexity. No CISA KEV listing is present, a public PoC reference exists but is not verified as working exploit code, and vuln.today prioritizes the issue as this_week.
Local privilege escalation to root affects the Amlogic Android SDK's pppoe_wrapper daemon as shipped on Nexbox A95X (Amlogic S905/S905X) TV boxes, where any unprivileged local process or app can send a crafted message to the world-writable AF_UNIX datagram socket at /dev/socket/pppoe_wrapper. A message beginning with 'pppd pty' and containing shell metacharacters is passed unfiltered to system(3) and executed by /system/bin/sh -c as root, giving full control of the device. Exploitation is local-only (CVSS 4.0 AV:L, independently assessed CVSS 3.1 AV:L/AC:L/PR:L/UI:N) and requires the attacker to already have local code execution; a public PoC reference exists but is not verified as working exploit code, and no CISA KEV active-exploitation entry is present.
An out-of-bounds stack write in the VobSub subtitle decoder (libsub_vob) of the Amlogic DroidLogic SubTitleService allows remote attackers to corrupt memory on Nexbox A95X (Amlogic S905X) TV boxes and other devices built from the Amlogic Android SDK. A crafted SET_CONTR command carrying an attacker-controlled alpha value drives the change_data index past the end of the fixed four-element PixelDatas array inside vob_fill_pixel(), zeroing adjacent stack bytes; the payload can arrive over the unauthenticated tcp/10100 socket or by getting the device to parse a malicious .sub file. No authentication and no user interaction are required, but the assessed impact is limited to silent stack corruption or a process crash rather than code execution, and the tcp/10100 service is typically LAN-exposed rather than internet-facing. A public PoC reference exists; it is not verified as working exploit code, and no confirmed active exploitation has been reported.
An infinite loop in the get_vob_spu() function of the libsub_vob VobSub subtitle decoder, part of Amlogic's DroidLogic SubTitleService shipped on Amlogic S905X-based devices such as the Nexbox A95X TV box, lets remote network attackers reachable on the LAN or local users loading a crafted file stall the subtitle decode thread at 100% CPU indefinitely, producing a denial of service. Two trigger paths are documented: sending a crafted AMLU data block with mismatched length fields to the unauthenticated tcp/10100 listener, or loading a malicious VobSub (.sub) file. No authentication or user interaction is required (CVSS 4.0 base 6.9 Medium; assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N with availability-only low impact), and only a public PoC reference exists - it is not verified as working exploit code, and no active exploitation has been confirmed. Exposure is bounded by the fact that tcp/10100 is a local service typically reachable only from the LAN, with no confidentiality or integrity impact and no code execution.