Nexbox A95X pppoe_wrapper command injection and subtitle service flaws

Summary

The pppoe_wrapper daemon in Amlogic's Android SDK on Nexbox A95X TV boxes lets a local user run commands as root. The box's subtitle service also has an infinite loop and an out-of-bounds write, and one of them is reachable over the network on tcp/10100.

Affected when

• Nexbox A95X (Amlogic S905/S905X) TV box
• a local user or app on the box
• tcp/10100 subtitle service listener (for the subtitle flaws)

What to do

No fixed version is named. Check that your box runs a build newer than NEXBOX-A95X-201606011847 and NEXBOX-A95X-AP6330, and read the vendor's advisory.

Update these devices now.

• Nexbox A95X

Products and platforms

• Amlogic Android SDK
• A95X
• Nexbox A95X

CVE IDs

• CVE-2026-119737 (opens in a new tab)
• CVE-2026-119738 (opens in a new tab)
• CVE-2026-119739 (opens in a new tab)

Sources

• Write-up: mstreet97.github.io (opens in a new tab) · vulncheck.com (opens in a new tab) · vulncheck.com (opens in a new tab) · vulncheck.com (opens in a new tab)
• CVE record: cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab)

Times

First published 2026-11-02 19:42 UTC

First seen 2026-11-09 14:10 UTC