Is CVE-2026-119740 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-119740 being exploited in the wild.

How severe is CVE-2026-119740?

Medium severity, with a CVSS score of 6.8, published 2 November 2026.

Which products and versions are affected?

Nexbox A95X A7_S905X_v2_2 20160713 and earlier.

Is there a fix for CVE-2026-119740?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-119740 attacked?

It is attacked with physical access, in a network appliance.

Am I affected by CVE-2026-119740?

Check whether you run Nexbox A95X at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-119740: Nexbox A95X unauthenticated console and command injection

CVE-2026-119740 · Severity: medium · CVSS 6.8 · Published 2026-11-02

The Nexbox A95X Android TV box exposes an unauthenticated serial console via a physical UART header that grants shell access without credentials. An attacker with physical access can use this access to reach the root-level pppoe_wrapper daemon, which is vulnerable to command injection, allowing complete compromise of the device.

Technologies: Nexbox A95X. Vendors: Nexbox.

Quick answers

Is CVE-2026-119740 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-119740 being exploited in the wild.
How severe is CVE-2026-119740?: Medium severity, with a CVSS score of 6.8, published 2 November 2026.
Which products and versions are affected?: Nexbox A95X A7_S905X_v2_2 20160713 and earlier.
Is there a fix for CVE-2026-119740?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-119740 attacked?: It is attacked with physical access, in a network appliance.
Am I affected by CVE-2026-119740?: Check whether you run Nexbox A95X at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability chains two issues: (1) an unauthenticated UART console (CWE-306) on the PCB header offering a shell as uid 2000 with no password, and (2) a CWE-78 OS command injection in the pppoe_wrapper root daemon that binds an AF_UNIX datagram socket with mode 777 and directly passes user-supplied command arguments to system() without validation. An attacker with physical access and a USB-to-TTL adapter can reach the pppoe_wrapper socket and inject arbitrary commands executed as root.

Affected products

Nexbox A95X A7_S905X_v2_2 20160713 and earlier

Timeline

2026-10-29: disclosed
2026-11-02: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.