{"affected":[{"defaultStatus":"unaffected","product":"A95X","source":"CNA: VulnCheck","vendor":"Nexbox","versions":[{"status":"affected","version":"NEXBOX-A95X-201606011847","versionType":"custom"},{"status":"affected","version":"NEXBOX-A95X-AP6330","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Amlogic Android SDK","source":"CNA: VulnCheck","vendor":"Amlogic","versions":[{"status":"affected","version":"0","versionType":"custom"}]}],"cveId":"CVE-2026-119737","cwes":["CWE-78"],"description":"The pppoe_wrapper vendor daemon from the Amlogic Android SDK, as shipped on Nexbox A95X (Amlogic S905/S905X) TV boxes, contains a command injection vulnerability that allows local attackers to execute arbitrary commands as root by sending crafted messages to a world-writable AF_UNIX datagram socket at /dev/socket/pppoe_wrapper. Attackers can send a message beginning with 'pppd pty' followed by shell metacharacters and arbitrary commands, which are passed unfiltered to system(3) and executed by /system/bin/sh -c as root, resulting in full privilege escalation.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: VulnCheck","url":"https://mstreet97.github.io/security-research/vulnerability-disclosure/embedded/cve/2026/10/29/From-UART-to-root-android-version.html"}],"kev":null,"metrics":[{"score":8.5,"severity":"high","source":"CNA: VulnCheck","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"},{"score":7.8,"severity":"high","source":"CNA: VulnCheck","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793652802739,"publishedAt":1793648569394,"references":[{"source":"CNA: VulnCheck","tags":["technical-description","exploit"],"url":"https://mstreet97.github.io/security-research/vulnerability-disclosure/embedded/cve/2026/10/29/From-UART-to-root-android-version.html"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/amlogic-pppoe-wrapper-command-injection-via-af-unix-socket"}],"remediation":[],"revision":"756152255aa98cda6e1bccb833129727383db4bbf3f73379592748d655f8f8c6","sources":[{"modifiedAt":1793652802739,"name":"CNA: VulnCheck","retrievedAt":1793653786641,"url":"https://www.cve.org/CVERecord?id=CVE-2026-119737"}],"ssvc":{"assessedAt":1793652774201,"automatable":"no","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Amlogic pppoe_wrapper Command Injection via AF_UNIX Socket","updatedAt":1793653786641}