CVE-2026-78745

CVE-2026-78745 is an improper access-control flaw (CWE-284) in the Android Debug Bridge daemon (adbd) of the HiDPTAndroid software stack for the Weyon/HiDPT Hi3751V350 and Hi3751V352E_DMO set-top-box platforms. A remote attacker who can reach the device's adbd service over the network can exploit the flaw to execute arbitrary code without credentials or user interaction, consistent with the 9.8 CVSS score (AV:N/AC:L/PR:N/UI:N). Affected products are Android TV set-top-box platforms built on the Hisilicon Hi3751V350 or Hi3751V352E_DMO silicon running the HiDPTAndroid build; the advisory data does not specify affected or fixed version ranges. Exploitation status is currently quiet: there is no known public proof-of-concept, the issue is not in CISA's KEV, and EPSS puts 30-day exploitation probability at 0.7% (52nd percentile).

What to do: Restrict or disable ADB over the network (classically TCP port 5555) on affected set-top boxes and block inbound access to adbd at the network edge, since the flaw is network-reachable without authentication. Contact the vendor for patched firmware for the Hi3751V350 and Hi3751V352E_DMO platforms, as no fixed versions are listed in the available data. Audit deployed devices to determine whether adbd is listening on any network interface and whether those devices are reachable from the internet or shared operator networks.