CVE-2026-58378Allwinner TV Box TV98 ADB exposed on network

Allwinner H616 TV Box TV98 has ADB enabled and exposed to the network on production. An attacker could request for ADB authorization and gain root level privileges if the victim allows access.

8.6 HIGHEPSS 0.44%Not in KEVNVD: Awaiting Analysis

Last updated: 2026-10-25 17:10 UTC

OverviewCVSS details

8.6HIGHCVSS 4.0

Score source: cisa-cg (CNA)
NVD status: Awaiting Analysis
Published: Jul 9, 2026
Assigner: cisa-cg

Affected

H616 (Allwinner)

Exploitation

Public exploit: None listed
CISA KEV: Not listed
KEV due date: —
SSVC: Exploitation poc · Automatable no · Impact total

EPSS · FIRST, scored Nov 7

0.44%chance of exploitation in 30 days

Higher than 38.65% of CVEs

CVSS 4.0 · cisa-cg (CNA)

8.6High

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: None
User interaction: Active
Confidentiality impact: High
Integrity impact: High
Availability impact: High
Confidentiality (other systems): None
Integrity (other systems): None
Availability (other systems): None

CVSS 3.1 · cisa-cg (CNA)

8.8High

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: Required
Scope: Unchanged
Confidentiality impact: High
Integrity impact: High
Availability impact: High

NVD status: Awaiting Analysis

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
8.6	HIGH	4.0cisa-cg (CNA)	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
8.8	HIGH	3.1cisa-cg (CNA)	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CVE ID: CVE-2026-58378
Status: Awaiting Analysis
Assigner (CNA): cisa-cg
Published: Jul 9, 2026
Last modified: 2026-10-25 17:10 UTC
Weaknesses: CWE-489 · Active Debug Code

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 07:46 UTC.