CVE-2026-58378 describes a vulnerability in the Allwinner H616 TV Box where the Android Debug Bridge (ADB) service is enabled and accessible on production devices over the network. An attacker can send a request for ADB authorization, and if the victim accepts, the attacker obtains root privileges on the device. This represents a critical security risk due to the potential for full system compromise. The vulnerability is categorized under CWE-489, which concerns active debug code left enabled in production environments. No patch or official remediation has been documented at this time.

Successful exploitation allows an attacker to gain root-level privileges on the affected device, leading to full control over the system, including confidentiality, integrity, and availability impacts. This could enable unauthorized access, data theft, device manipulation, or persistent compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid exposing ADB services on production devices to untrusted networks and refrain from authorizing unknown ADB connection requests.