CVE-2026-58378 describes a vulnerability in the Allwinner H616 TV Box where the Android Debug Bridge (ADB) service is enabled and accessible on production devices over the network. This exposure allows an attacker to request ADB authorization remotely. If the user authorizes the request, the attacker gains root privileges, leading to full control over the device. The vulnerability is categorized as CWE-489, indicating the presence of active debug code in a production environment, which should typically be disabled to prevent unauthorized access.

Successful exploitation grants an attacker root-level privileges on the affected device, compromising confidentiality, integrity, and availability. This could lead to full device takeover, data theft, or disruption of device functionality. The CVSS v3.1 score is 8.8 (high severity), reflecting network attack vector, low attack complexity, no privileges required initially, but user interaction is needed to authorize access.

No official patch or remediation guidance is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is provided, users should avoid connecting the device to untrusted networks and refrain from authorizing unknown ADB access requests. Disabling ADB on production devices is recommended if possible.