Home

Description

Allwinner H616 TV Box TV98 has ADB enabled and exposed to the network on production. An attacker could request for ADB authorization and gain root level privileges if the victim allows access.

PUBLISHED Reserved 2026-06-30 | Published 2026-07-09 | Updated 2026-07-09 | Assigner cisa-cg




HIGH: 8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
HIGH: 8.6CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Problem types

CWE-489 Active Debug Code

Product status

Default status
affected

Any version before *
affected

Credits

RelunSec

References

www.cve.org/CVERecord?id=CVE-2026-58378 (url) vdb-entry

raw.githubusercontent.com/...IT/white/2026/va-26-190-03.json (url) third-party-advisory

cve.org (CVE-2026-58378)

nvd.nist.gov (CVE-2026-58378)

Download JSON