Nexbox - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/nexbox/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 02 Nov 2026 21:52:04 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAmlogic Android SDK: pppoe_wrapper root command injection (CVE-2026-119737)https://feed.craftedsignal.io/briefs/2026-11-amlogic-pppoe-wrapper/Mon, 02 Nov 2026 21:52:04 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-amlogic-pppoe-wrapper/A command injection vulnerability in the pppoe_wrapper daemon on Amlogic-based Android TV boxes allows local attackers to achieve root privilege escalation by sending malicious payloads to a world-writable AF_UNIX socket.The pppoe_wrapper vendor daemon within the Amlogic Android SDK, utilized in devices such as the Nexbox A95X (Amlogic S905/S905X), is vulnerable to command injection. An attacker with local access can interact with a world-writable AF_UNIX datagram socket located at /dev/socket/pppoe_wrapper. By crafting a message starting with 'pppd pty' followed by shell metacharacters, the input is passed to system(3) and executed with root privileges via /system/bin/sh -c. This results in full system compromise. No patch information is currently provided.

Impact

Successful exploitation results in full root privilege escalation on the affected Android device.

Recommendation

Identify and audit devices running the Amlogic Android SDK for the presence of the world-writable /dev/socket/pppoe_wrapper socket. If the service is not required for production functionality, disable the pppoe_wrapper daemon or restrict access permissions to the socket file if the underlying operating system and hardware configuration permit.

]]>highadvisory