CVE-2026-58378

Allwinner H616 TV Box TV98 has ADB enabled and exposed to the network on production. An attacker could request for ADB authorization and gain root level privileges if the victim allows access.

CVSS 4.0

8.6CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.4% chance of exploitation in the next 30 days; higher than 38% of CVEs (scores of 2026-10-25)

CWE

CWE-489

Published

2026-07-09

Modified

2026-10-25

Record from

the NVD, synced 2026-10-25

References

• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-190-03.json
• https://www.cve.org/CVERecord?id=CVE-2026-58378

Check your stackJSON