CVE-2026-58378: Allwinner TV Box TV98 ADB exposed on network

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-09 · updated 2026-10-25
Weakness: CWE-489

Description

Allwinner H616 TV Box TV98 has ADB enabled and exposed to the network on production. An attacker could request for ADB authorization and gain root level privileges if the victim allows access.

Affected products

Allwinner H616: all versions

References

https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-190-03.json
https://www.cve.org/CVERecord?id=CVE-2026-58378

Get alerted when CVE-2026-58378 or the next vulnerability affects your stack