Executive brief
The Code 27 Companion Hub, an AI-powered desktop device, contains a security flaw that allows someone with physical access to take control of the system. By booting the device into a specific maintenance mode and connecting it to a computer via USB, an attacker can gain administrative (root) access. This could allow them to modify the device's software, install malicious code, or compromise the device's long-term security.
Technical details
The Code 27 Companion Hub ships with a 'userdebug' Android build, which leaves the Android Debug Bridge (ADB) daemon (adbd) capable of being restarted with root privileges. An attacker with physical access can boot the device into the Android recovery menu using hardware button combinations. Once in recovery, the attacker can connect via USB and use 'adb root' to obtain a shell with UID 0 and the 'u:r:su:s0' SELinux context. While the live system partition may not be immediately mounted, this root access to the recovery environment allows for the modification of persistent partitions or the sideloading of malicious update packages to achieve permanent code execution on subsequent boots.
Affected products
- Code 27 Companion Hub SQ3A.220705.003.A1
Timeline
- 2026-07-08: disclosed: Vulnerability published via NVD and researcher GitHub repository.