CVE-2020-27402
The HK1 Box S905X3 TV Box contains a vulnerability that allows a local unprivileged user to...
The HK1 Box S905X3 TV Box contains a vulnerability that allows a local unprivileged user to escalate to root using the /system/xbin/su binary via a serial port (UART) connection or using adb.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The HK1 Box S905X3 TV Box contains a vulnerability that allows a local unprivileged user to escalate to root using the /system/xbin/su binary via a serial port (UART) connection or using adb.
- Record
CVE-2020-27402- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE List No score
The HK1 Box S905X3 TV Box contains a vulnerability that allows a local unprivileged user to escalate to root using the /system/xbin/su binary via a serial port (UART) connection or using adb.
- Record
CVE-2020-27402- Updated
- 2026-11-02
EUVDEUVD-2020-19913 No score
The HK1 Box S905X3 TV Box contains a vulnerability that allows a local unprivileged user to escalate to root using the /system/xbin/su binary via a serial port (UART) connection or using adb.
- Record
EUVD-2020-19913- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8f2f-5ppm-5q4x No score
The HK1 Box S905X3 TV Box contains a vulnerability that allows a local unprivileged user to...
The HK1 Box S905X3 TV Box contains a vulnerability that allows a local unprivileged user to escalate to root using the /system/xbin/su binary via a serial port (UART) connection or using adb.
- Record
GHSA-8f2f-5ppm-5q4x- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-27402 is a high vulnerability (CVSS 7.8) in Hindotech Hk1 Box S905x3 Firmware, published November 5, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.54%, the 45th percentile. No source names a fixed version.
References
threatpost.com/authentication-bug-android-smart-tv-data-theft/160025
cybersecurity-help.cz/vdb/SB2020101404
securitylab.ru/news/513051.php
sick.codes/sick-2020-004
github.com/sickcodes/security/blob/master/advisories/SICK-2020-004.md
nvd.nist.gov/vuln/detail/CVE-2020-27402