CVE-2026-119737 Amlogic pppoe_wrapper Command Injection via AF_UNIX Socket
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-119737?
CVE-2026-119737 is a high-severity vulnerability in Amlogic A95X, published on 2 Nov 2026.
Official description
The pppoe_wrapper vendor daemon from the Amlogic Android SDK, as shipped on Nexbox A95X (Amlogic S905/S905X) TV boxes, contains a command injection vulnerability that allows local attackers to execute arbitrary commands as root by sending crafted messages to a world-writable AF_UNIX datagram socket at /dev/socket/pppoe_wrapper. Attackers can send a message beginning with 'pppd pty' followed by shell metacharacters and arbitrary commands, which are passed unfiltered to system(3) and executed by /system/bin/sh -c as root, resulting in full privilege escalation.
Weakness: CWE-78
Which versions are affected by CVE-2026-119737?
How do I fix CVE-2026-119737?
No fix has been published for CVE-2026-119737 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-119737 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-119737 exists.
Sources
Also known as GHSA-cqfv-369w-xpwm.