CVE-2020-28055: tcl 32s330 firmware +6 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2020-28055

CVSS 7.8 · High EPSS 0,51%

Kerentanan Incorrect Permission Assignment for Critical Resource pada tcl 32s330 firmware, tcl 40s330 firmware +5 lainnya. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

A vulnerability in the TCL Android Smart TV series V8-R851T02-LF1 V295 and below and V8-T658T01-LF1 V373 and below by TCL Technology Group Corporation allows a local unprivileged attacker, such as a malicious App, to read & write to the /data/vendor/tcl, /data/vendor/upgrade, and /var/TerminalManager directories within the TV file system. An attacker, such as a malicious APK or local unprivileged user could perform fake system upgrades by writing to the /data/vendor/upgrage folder.

Rincian

Terbit di NVD: 10 November 2020
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-732: Incorrect Permission Assignment for Critical Resource
EPSS (30 hari): 0,51% peluang dieksploitasi; lebih tinggi dari 41,6% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
tcl	32s330 firmware	Semua versi sebelum v8-r851t10-lf1v091
tcl	40s330 firmware	Semua versi sebelum v8-r851t10-lf1v091
tcl	43s434 firmware	Semua versi sebelum v8-r851t02-lf1v440
tcl	50s434 firmware	Semua versi sebelum v8-r851t02-lf1v440
tcl	55s434 firmware	Semua versi sebelum v8-r851t02-lf1v440
tcl	65s434 firmware	Semua versi sebelum v8-r851t02-lf1v440
tcl	75s434 firmware	Semua versi sebelum v8-r851t02-lf1v440

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://support.tcl.com/vulnerabilities-found-in-tcl-android-tvs advisory vendor
https://github.com/sickcodes/security/blob/master/advisories/SICK-2020-012.md exploit · advisory pihak ketiga
https://github.com/sickcodes/security/blob/master/etc/CVE-2020-27403_CVE-2020-28055_GlobalFAQ.pdf advisory pihak ketiga
https://github.com/sickcodes/security/blob/master/etc/CVE-2020-27403_CVE-2020-28055_Press-Statement-and-Questi... advisory pihak ketiga
https://securityledger.com/2020/11/security-holes-opened-back-door-to-tcl-android-smart-tvs/ advisory pihak ketiga
https://securityledger.com/2020/11/tv-maker-tcl-denies-back-door-promises-better-process/ advisory pihak ketiga
https://sick.codes/extraordinary-vulnerabilities-discovered-in-tcl-android-tvs-now-worlds-3rd-largest-tv-manuf... exploit · advisory pihak ketiga
https://sick.codes/sick-2020-012 exploit · advisory pihak ketiga
https://twitter.com/johnjhacking/ advisory pihak ketiga
https://twitter.com/sickcodes/ advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.