CVE-2026-119737 in A95X
Summary
by MITRE • 11/02/2026
The pppoe_wrapper vendor daemon from the Amlogic Android SDK, as shipped on Nexbox A95X (Amlogic S905/S905X) TV boxes, contains a command injection vulnerability that allows local attackers to execute arbitrary commands as root by sending crafted messages to a world-writable AF_UNIX datagram socket at /dev/socket/pppoe_wrapper. Attackers can send a message beginning with 'pppd pty' followed by shell metacharacters and arbitrary commands, which are passed unfiltered to system(3) and executed by /system/bin/sh -c as root, resulting in full privilege escalation.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/02/2026
The vulnerability identified in the Amlogic Android SDK's pppoe_wrapper daemon represents a critical security flaw within embedded television box hardware, specifically affecting models such as the Nexbox A95X powered by Amlogic S905 or S905X processors. This component is responsible for managing Point-to-Point Protocol over Ethernet connections, a legacy networking protocol often utilized in broadband setups. The core of the issue lies in how this vendor-specific daemon processes incoming network configuration messages. Rather than implementing strict input validation and sanitization routines, the application blindly passes user-supplied data directly into system execution functions without filtering for shell metacharacters or command boundaries. This architectural oversight creates a direct pathway for local privilege escalation, allowing any process with access to specific inter-process communication channels to gain root-level control over the device operating system.
From a technical perspective, the flaw is rooted in improper input validation and unsafe use of system APIs. The pppoe_wrapper daemon exposes an AF_UNIX datagram socket located at /dev/socket/pppoe_wrapper, which is configured with world-writable permissions. This permission setting allows any local application or user account on the Android device to send data to this endpoint without authentication. When a message is received that begins with the string 'pppd pty', the daemon constructs a shell command by appending the rest of the input directly to it and executes it using system(3). The underlying mechanism invokes /system/bin/sh -c, which interprets standard shell metacharacters such as semicolons, pipes, or ampersands. Consequently, an attacker can craft a payload that terminates the intended pppd command and injects arbitrary Linux commands to be executed with root privileges. This is a classic example of Command Injection, where untrusted data influences the structure or execution of system-level operations.
The operational impact of this vulnerability is severe due to the resulting full privilege escalation. In Android-based TV boxes, gaining root access typically bypasses all sandboxing mechanisms enforced by the operating system. An attacker can read sensitive user data including personal information stored in application directories, intercept network traffic intended for other processes, or modify system configurations that control device behavior. Furthermore, persistent backdoors can be installed to maintain long-term unauthorized access even after reboots. This level of compromise undermines the integrity and confidentiality guarantees expected from consumer electronics devices, potentially turning a smart TV box into a node in larger botnets or a tool for further lateral movement within home networks if other security boundaries are also weak.
This vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command commonly known as OS Command Injection and CWE-250 Execution with Unnecessary Privileges, as the daemon operates with root permissions while processing untrusted input. In terms of adversary tactics, this exploitation vector corresponds to ATT&CK technique T1059 Command and Scripting Interpreter, specifically leveraging shell commands for execution, and potentially T1068 Exploitation for Privilege Escalation if used to gain higher access levels from a lower-privileged context. The reliance on world-writable sockets also reflects CWE-732 Incorrect Permission Assignment for Critical Resource, indicating a failure in implementing the principle of least privilege during service configuration.
Mitigation strategies must address both the immediate technical flaw and broader security hygiene practices inherent in embedded Android development. For device manufacturers, it is imperative to restrict permissions on inter-process communication sockets so that only authorized system services can interact with pppoe_wrapper, thereby removing the local attack surface for arbitrary applications. Input validation mechanisms should be implemented within the daemon to strictly whitelist allowed characters or parse inputs using safe APIs rather than passing raw strings to shell interpreters. If shell execution is unavoidable, arguments must be passed directly as array parameters to execve family functions instead of through a shell intermediary like sh -c. Additionally, enabling SELinux policies that confine vendor daemons can limit the blast radius even if an injection occurs by preventing access to critical system resources outside the daemon's designated domain.