CVE-2026-119740: Nexbox A95X Amlogic S905X UART Unauthenticated Console Access

Published Nov 2, 2026

Updated

Nexbox A95X TV boxes built on the Amlogic S905X platform contain an unauthenticated console exposed via an internal UART header on the PCB that allows physical attackers to obtain an interactive shell as uid 2000 (system) without any credentials. Attackers with physical access and a USB-to-TTL adapter can leverage this shell to reach the pppoewrapper vendor daemon, which contains an OS command injection vulnerability executed as root, resulting in full root-level compromise of the device.

Event History

Nov 2, 2026

CVE Published

via MITRE·07:54 PM

Data Sourced

via MITRE·07:54 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is realistically exposed to this issue?

Nexbox A95X TV boxes built on the Amlogic S905X platform are affected when an attacker can physically access the device and its internal PCB UART header. Remote-only attackers are not described as being able to use this path.

What does an attacker need to achieve full compromise?

The attacker needs physical access to the device and a USB-to-TTL adapter to connect to the internal UART header. The exposed console requires no credentials and provides a shell as uid 2000 (system), from which the attacker can exploit command injection in the root-executed pppoe_wrapper daemon.

Is authentication required for the initial console access?

No. The internal UART console is described as unauthenticated, allowing an interactive system-level shell without credentials.

What can be done if a software fix is not immediately available?

Restrict physical access to the TV box and prevent access to its internal PCB and UART header. Because exploitation requires a physical UART connection, tamper-resistant placement or enclosure controls can reduce exposure.

CVE-2026-119740: Nexbox A95X Amlogic S905X UART Unauthenticated Console Access

Event History

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to achieve full compromise?

Is authentication required for the initial console access?

What can be done if a software fix is not immediately available?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to achieve full compromise?

Is authentication required for the initial console access?

What can be done if a software fix is not immediately available?