CVE-2026-78745 in Android
Summary
by MITRE • 09/04/2026
An issue in HiDPT/ Weyon HiDPTAndroid Hi3751V350 Hi3751V352E_DMO allows a remote attacker to execute arbitrary code via the Android Debug Bridge (ADB) daemon (adbd)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified in the HiDPT and Weyon HiDPTAndroid platforms, specifically affecting the Hi3751V350 and Hi3751V352E_DMO hardware variants, represents a critical security flaw within the Android Debug Bridge daemon. This component, known as adbd, serves as the primary interface for developers to interact with an Android device during debugging sessions. The core issue stems from insufficient validation or authentication mechanisms inherent in how the ADB service handles incoming connections on these specific embedded systems. By exploiting this weakness, a remote attacker can bypass standard security controls and establish an unauthorized connection to the system. This capability allows the execution of arbitrary commands with the elevated privileges typically granted to the adbd process, which often runs as root or has significant access to device resources.
From a technical perspective, the flaw likely resides in the configuration or implementation of the ADB service itself, potentially involving default credentials that remain unchanged from factory settings or a lack of secure boot verification for debugging interfaces. In many embedded Android deployments used in digital signage and point-of-sale terminals, developers may leave USB debugging enabled to facilitate updates or diagnostics without realizing the persistent risk it poses when connected to networks or exposed via wireless tethering. The absence of proper access control lists or cryptographic handshake requirements enables an adversary to inject malicious payloads directly into the operating system environment. This aligns with common failure modes described in CWE-287, which covers Improper Authentication, and CWE-94, describing Code Injection vulnerabilities where untrusted input is executed as code without adequate sanitization.
The operational impact of this vulnerability is severe due to the privileged nature of the ADB daemon. Once an attacker gains access through adbd, they effectively compromise the integrity and confidentiality of the entire device. This can lead to full system takeover, allowing the installation of persistent malware, exfiltration of sensitive user data stored on the device, or modification of critical system files that control hardware functionality such as display output or network connectivity. In a commercial context involving HiDPT devices used for digital advertising or retail information displays, this could result in unauthorized content injection, defacement of public-facing screens, or using the compromised device as a pivot point to attack other systems on the local network. Such scenarios are consistent with techniques documented in the MITRE ATT&CK framework under Initial Access via Valid Accounts and Execution through Command and Script Interpretation.
Mitigation strategies must focus on hardening the ADB interface and reducing the attack surface of these embedded devices. The most effective immediate measure is to disable USB debugging entirely when not actively required for development or maintenance purposes, as this removes the primary vector for exploitation. If remote access via network-based ADB over TCP/IP is necessary, it should be strictly limited by implementing strong authentication mechanisms rather than relying on default configurations. Furthermore, organizations deploying these devices should ensure that firmware updates are applied promptly to patch known vulnerabilities in the underlying Android framework and HiSilicon chipset drivers. Network segmentation policies should also be enforced to isolate IoT and digital signage devices from critical corporate infrastructure, limiting lateral movement potential if a breach occurs. Regular security audits focusing on default credential usage and unnecessary service exposure will further reduce the risk of exploitation by automated scanners or targeted attackers seeking to leverage this specific weakness in Hi3751-based hardware.