Amlogic pppoe_wrapper Command Injection via AF_UNIX Socket

Summary

The pppoe_wrapper vendor daemon from the Amlogic Android SDK, as shipped on Nexbox A95X (Amlogic S905/S905X) TV boxes, contains a command injection vulnerability that allows local attackers to execute arbitrary commands as root by sending crafted messages to a world-writable AF_UNIX datagram socket at /dev/socket/pppoe_wrapper. Attackers can send a message beginning with 'pppd pty' followed by shell metacharacters and arbitrary commands, which are passed unfiltered to system(3) and executed by /system/bin/sh -c as root, resulting in full privilege escalation.

Remediation

1. Inventory every Nexbox A95X deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Advisoryhttps://www.vulncheck.com/advisories/amlogic-pppoe-wrapper-command-injection-via-af-unix-socket
• Referencehttps://mstreet97.github.io/security-research/vulnerability-disclosure/embedded/cve/2026/10/29/From-UART-to-root-android-version.html