Threats tagged 'ghsa-7prp-vrqq-87rq'

Nexbox A95X TV boxes using the Amlogic S905X platform have an unauthenticated console accessible via an internal UART header. This allows physical attackers with a USB-to-TTL adapter to obtain an interactive shell as uid 2000 (system) without credentials. From this shell, attackers can exploit an OS command injection vulnerability in the pppoe_wrapper vendor daemon running as root, leading to full root-level compromise of the device.