CVE-2026-58378

Executive Summary

CVE-2026-58378 is an unauthenticated Android Debug Bridge (ADB) exposure vulnerability affecting the Allwinner H616-based TV98 TV box. The device ships with ADB enabled and listening on the network interface, allowing any remote attacker to initiate an ADB authorization request. If a user on the device accepts the RSA key prompt, the attacker gains root-level shell access over the network — leading to full device compromise, credential theft, and potential use of the device as a pivot point into the home network. There is no patch available; all TV98 units in production are affected.

Technical Analysis

The vulnerability is rooted in a production configuration flaw: the ADB daemon (adbd) is started with network listening enabled (adb tcpip 5555) rather than restricted to USB. The Allwinner H616 SoC runs Android (typically Android 9-11 in TV boxes), where adbd runs with root privileges by default in userdebug/eng builds. The TV98 firmware ships in a userdebug state, meaning adbd does not drop privileges after startup.

From a code perspective, the Android adbd implementation listens on TCP port 5555 and performs an RSA-key-based authentication handshake. When an unauthorized host connects, adbd presents a prompt on the device's display: "Allow USB debugging?" with an RSA key fingerprint. The vulnerability is that this prompt is shown on a TV screen, which is not an interactive input surface — most users do not have a keyboard/mouse connected, and the default timeout behavior on many TV boxes auto-accepts the prompt after a short delay or leaves the "Always allow from this computer" checkbox checked by default. This effectively reduces the requirement to UI:R (user interaction) to a near-certainty, as the device owners often accept any prompt to dismiss it or the firmware auto-accepts.

The attack surface is the TCP port 5555 exposed on the network interface. The TV98 is a consumer device typically connected to a home router. ADB protocol operates on a length-prefixed message framing: 24-byte header (CNXN, AUTH, OPEN, etc.) followed by a 4-byte payload length and payload. The AUTH message contains the host's RSA public key (2048-bit). The device responds with AUTH (signature verification) and then either CNXN (connection established — if the key was previously authorized) or an AUTH challenge requiring the user to accept.

The vulnerability class is CWE-306 (Missing Authentication for Critical Function). While ADB does have an authentication mechanism (RSA key pairing), it relies on interactive user acceptance — which fails on a headless TV box. The device ships with the authorization prompt effectively defaulting to "allow," or the ADB key store (/data/misc/adb/adb_keys) is pre-populated with a manufacturer debugging key. If the latter is true, no user interaction is required at all, and the CVSS score of 8.8 may understate the severity.

Additional technical details:

• ADB over TCP uses port 5555 by default.
• Once connected, adb root restarts adbd running as root (if the build type is userdebug or eng).
• The device exposes the full Android OS — access to /data, /system, and hardware peripherals (camera, microphone, IR blaster).
• The H616 chipset has no secure boot enforcement in this firmware; a rooted shell can easily write to the boot partition.
• The TV box is often connected via Wi-Fi or Ethernet to the same LAN as other IoT devices and possibly the main workstation.

Exploitation Scenarios

Attack Chain: Full Compromise of TV98 and LAN Pivot

Step 1 — Reconnaissance (Network Scanning): The attacker scans for exposed ADB services. Using Nmap:

nmap -p 5555 --open -sV -T4 <target-range>

The service banner will identify android or ADB on port 5555. Additionally, Shodan/Censys can be used with the query port:5555 "Android Debug Bridge" to find internet-exposed devices (if the router has port forwarding or UPnP enabled — common in default router configs).

Step 2 — ADB Connection and Trigger: The attacker connects to the target:

adb connect <target-ip>:5555
adb shell

If the TV98 firmware has a pre-populated adb_keys file (manufacturer debug key), the connection is established instantly without any prompt. If not, a prompt will briefly appear on the TV screen. On many TV boxes, this auto-accepts within 10-30 seconds, or the user presses "OK" on the remote without reading it.

Step 3 — Privilege Escalation (Root):

adb root   # Restarts adbd in root mode — requires USERDEBUG build
adb wait-for-device
adb shell

Now running as root (uid=0), the attacker can:

• Extract Wi-Fi credentials: cat /data/misc/wifi/WifiConfigStore.xml
• Dump installed APK data: adb backup -f backup.ab -apk -all
• Read the ADB key store to harvest the device's own RSA keys for lateral movement.

Step 4 — Persistence (Boot-level backdoor):

adb push /path/to/backdoor.apk /system/app/
adb shell chmod 644 /system/app/backdoor.apk
adb reboot

Or install a persistent reverse-shell that reconnects to a C2 server on each boot.

Step 5 — Post-exploitation / Lateral Movement: The TV box is now fully owned. The attacker uses it as a pivot:

# On the TV box, scan the LAN:
adb shell "ip route | grep default | awk '{print $3}'"  # gateway IP
adb shell "nmap -sS <gateway-ip>/24"  # requires nmap binary, else use busybox

The device becomes a stealthy presence — it runs 24/7 (TV box), is rarely rebooted, and is not monitored by any enterprise AV. It can harvest credentials from adjacent devices if they use broadcast protocols or ARP spoofing (arpspoof via busybox).

Step 6 — Data Exfiltration: The attacker can stream the TV box's microphone (if present), capture HDMI input (if the box has HDMI-in), or use it to relay traffic through an SSH tunnel to avoid detection.

Impact Assessment

The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H yields a base score of 8.8 (High). The key subscores:

• Confidentiality Impact: High — the device stores Wi-Fi passwords, streaming service credentials, smart-home controller credentials (if the TV box is an automation hub), and potentially browser cookies from the Android TV browser.
• Integrity Impact: High — a root shell can modify any file, install malicious APKs, replace system certificates to enable TLS interception for other local traffic.
• Availability Impact: High — the device can be bricked by corrupting the boot partition or used as a bot in DDoS attacks.

Business impact: For enterprise environments, the risk is indirect but real. A TV box in an executive's home office is connected to the same LAN as the corporate laptop (via VPN or even direct network connection). An attacker who compromises the TV box can:

1. Perform ARP spoofing to intercept corporate laptop traffic (if the laptop is on the same physical network).
2. Capture credentials during VPN handshake or voice/video calls.
3. Use the device as a persistent foothold for later attacks when the laptop connects.
4. Exploit the TV box's position as a "trusted" device in smart-home scenarios to unlock smart locks, disable alarms, or access camera feeds.

Blast radius: Affects all TV98 devices with firmware released before the CVE publication date. Given that TV box firmware is rarely updated, the actual installed base remains fully vulnerable for the foreseeable future. The lack of patch (confidence 0/4) means this is a permanent flaw for affected devices.

Detection Guidance

Sigma Rule

title: ADB Network Connection - Unauthorized ADB Access
id: a5c9e0f1-2b4d-4e8a-9f3c-7d5e8a1b2c3d
status: experimental
description: Detects unauthorized Android Debug Bridge (ADB) connections to the TV98 device on port 5555.
logsource:
    product: linux
    category: network_connection
detection:
    selection:
        dest_port: 5555
        process_name: adbd
        initiator: remote
    condition: selection
falsepositives:
    - Legitimate developer access to TV98 for debugging
level: high
tags:
    - attack.t1190
    - cve.2026.58378

YARA Rule

rule ADB_TV98_UNAUTHORIZED_SESSION
{
    meta:
        author = "Valters IT Security"
        description = "Detects ADB session establishment to TV98 device - CVE-2026-58378"
        date = "2026-01-01"
        cve = "CVE-2026-58378"
    strings:
        $cnxn = "CNXN" ascii
        $auth = "AUTH" ascii
        $open = "OPEN" ascii
        $adbd_svc = "shell" ascii
        $root_cmd = "root" ascii
        $adb_keys = "adb_keys" ascii
    condition:
        filesize < 10MB and
        (($cnxn and $auth) or ($cnxn and $open)) and
        ($adbd_svc or $root_cmd or $adb_keys)
}

Suricata IDS Rule

alert tcp any any -> any 5555 (msg:"CVE-2026-58378 - Unauthorized ADB connection attempt to TV98"; flow:to_server; content:"CNXN"; offset:0; depth:4; content:"AUTH"; within:20; reference:cve,2026-58378; classtype:attempted-admin; sid:10058378; rev:1;)

Elastic Detection

network where destination.port == 5555 and
  network.direction == "inbound" and
  process.name == "adbd" and
  not source.ip in ("127.0.0.1", "::1", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")

Splunk SPL Query

index=network sourcetype=cisco:asa OR sourcetype=netflow
| where dest_port=5555
| eval src_ip=coalesce(src_ip, source_address)
| eval dest_ip=coalesce(dest_ip, destination_address)
| stats count by src_ip, dest_ip, dest_port
| table src_ip, dest_ip, dest_port, count
| search dest_port=5555

Wazuh OSSEC Rule

<group name="cve-2026-58378,">
  <rule id="777090" level="12">
    <if_sid>5710</if_sid>  <!-- Network connection event -->
    <match>5555</match>
    <regex>adbd|Android Debug Bridge</regex>
    <description>Unauthorized ADB connection to TV98 device - CVE-2026-58378</description>
    <group>cve_2026_58378,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor fix, no workaround from the vendor.

Immediate mitigations (do these today):

1. Disable ADB over network — connect via ADB over USB and run:

   adb shell "adb tcpip 0"        # Disable TCP mode
   adb shell "setprop persist.adb.tcp.port -1"
   

2. Disable ADB entirely — through the Android TV settings: Settings → Developer Options → toggle off "USB debugging" and "Network debugging".
3. Firewall rule — block inbound port 5555 from all sources except trusted management addresses:

   iptables -A INPUT -p tcp --dport 5555 -s 0/0 -j DROP
   iptables -A INPUT -p tcp --dport 5555 -s 192.168.1.0/24 -j ACCEPT
   

4. Router-level mitigation — disable UPnP, ensure port 5555 is not forwarded, set the TV box on a separate VLAN/SSID from sensitive devices.
5. Network monitoring — alert on any connection to the TV box on port 5555 (see Detection Guidance above).

Patch/upgrade steps:

• No patch exists. Monitor the vendor's website (cisa-cg or the TV98 manufacturer) for a firmware update.
• If a firmware update is released, apply it immediately and re-verify that ADB is not exposed on the network.

Long-term hardening:

1. Replace the TV98 with a vendor that provides security-patched firmware (e.g., not a white-label Android TV box).
2. If the device must remain, root it yourself and modify the firmware to disable ADB on boot:
   • Edit /system/build.prop — set ro.adb.secure=1 and persist.sys.usb.config=mtp.
   • Remove the adbd network listener from the init scripts.
3. Place the device on an isolated network segment (VLAN) with no access to critical systems.
4. Enable MAC address filtering on the router to prevent DHCP changes.
5. Regularly audit the device for new listening ports or unexpected processes.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-58378
2. CWE-306 Reference: https://cwe.mitre.org/data/definitions/306.html — Missing Authentication for Critical Function
3. Android ADB Protocol Documentation: https://android.googlesource.com/platform/packages/modules/adb/+/refs/heads/main/OVERVIEW.md
4. Exploit-DB / Public PoC: Search for "TV98 ADB" on Exploit-DB and GitHub (public PoC exists as of publication).
5. CISA KEV: Not listed — no known exploitation in the wild as of writing.

Threat actor context: No known state-sponsored campaigns attributed to this CVE. However, the vulnerability class (unauthenticated ADB) has been actively exploited by the "Godsgift" Android botnet and various banking trojans in 2023-2025 campaigns targeting exposed ADB devices on consumer networks. Given the public PoC and the high CVSS score, expect weaponization in commodity IoT botnets within 30-60 days of publication.