{"id":"CVE-2026-58378","state":"PUBLISHED","title":"Allwinner TV Box TV98 ADB exposed on network","description":"Allwinner H616 TV Box TV98 has ADB enabled and exposed to the network on production. An attacker could request for ADB authorization and gain root level privileges if the victim allows access.","publishedAt":"2026-07-09T17:46:00.635Z","updatedAt":"2026-07-21T17:05:27.203Z","severity":{"score":8.6,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"cisa-cg"},"assigner":"cisa-cg","products":["Allwinner H616"],"affected":[{"vendor":"Allwinner","product":"H616","defaultStatus":"affected","versions":[{"version":"0","status":"affected","lessThan":"*","versionType":"custom"}]}],"references":["https://www.cve.org/CVERecord?id=CVE-2026-58378","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-190-03.json"],"weaknesses":["CWE-489"],"ingestedAt":"2026-10-29T20:12:24.861Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/58xxx/CVE-2026-58378.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-58378","state":"PUBLISHED","datePublished":"2026-07-09T17:46:00.635Z","dateUpdated":"2026-07-21T17:05:27.203Z","assignerShortName":"cisa-cg","assignerOrgId":"9119a7d8-5eab-497f-8521-727c672e3725","dateReserved":"2026-06-30T15:25:14.279Z"},"containers":{"cna":{"title":"Allwinner TV Box TV98 ADB exposed on network","descriptions":[{"lang":"en","value":"Allwinner H616 TV Box TV98 has ADB enabled and exposed to the network on production. An attacker could request for ADB authorization and gain root level privileges if the victim allows access."}],"affected":[{"vendor":"Allwinner","product":"H616","defaultStatus":"affected","versions":[{"version":"0","status":"affected","lessThan":"*","versionType":"custom"}]}],"references":[{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58378","name":"url","tags":["vdb-entry"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-190-03.json","name":"url","tags":["third-party-advisory"]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"cvssV4_0":{"version":"4.0","baseScore":8.6,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"ACTIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-06-30T15:22:25.463122Z","id":"CVE-2026-58378","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-489","description":"CWE-489 Active Debug Code","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"cisa-cg","orgId":"9119a7d8-5eab-497f-8521-727c672e3725","dateUpdated":"2026-07-09T17:46:00.635Z"},"credits":[{"value":"RelunSec","lang":"en"}],"datePublic":"2026-07-09T00:00:00.000Z"},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-07-21T17:04:41.904064Z","id":"CVE-2026-58378","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-07-21T17:05:27.203Z"}}]}}}