What is CVE-2026-119737?
CVE-2026-119737 is a high-severity command injection vulnerability affecting the pppoe_wrapper vendor daemon within the Amlogic Android SDK. As documented in CVE-2026-58946: Vulnerabilidad Crítica CVSS 8.4 de Escalada de Privilegios, local privilege escalation flaws pose severe threats to embedded systems.
Specifically, the vulnerability exists in devices such as the Nexbox A95X running on Amlogic S905 and S905X chips. Additional technical details can be found on Referencia técnica en mstreet97.github.io and regarding how the daemon operates.
How does the command injection work?
Local attackers can exploit this flaw by sending crafted messages to a world-writable AF_UNIX datagram socket located at /dev/socket/pppoe_wrapper. Similar local risks have been analyzed previously, such as Vulnerabilidad crítica CVE-2026-115905 con CVSS 10.0 en la librería zip de Rust and CVE-2026-58946: Vulnerabilidad Crítica CVSS 8.4 de Escalada de Privilegios.
When a message begins with 'pppd pty' followed by shell metacharacters and arbitrary commands, the input is passed unfiltered to system(3). It is then executed by /system/bin/sh -c with root privileges.
How do I secure my device?
To protect vulnerable TV boxes from local privilege escalation, operators and security researchers must apply stringent restrictions on the affected socket file permissions.
Official security advisories are tracked by the National Vulnerability Database at NIST NVD and CVE.org for any upcoming vendor updates.