GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

FKIE_CVE-2020-28055

Vulnerability from fkie_nvd - Published: 2020-11-10 18:15 - Updated: 2026-06-17 03:10
Severity
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
A vulnerability in the TCL Android Smart TV series V8-R851T02-LF1 V295 and below and V8-T658T01-LF1 V373 and below by TCL Technology Group Corporation allows a local unprivileged attacker, such as a malicious App, to read & write to the /data/vendor/tcl, /data/vendor/upgrade, and /var/TerminalManager directories within the TV file system. An attacker, such as a malicious APK or local unprivileged user could perform fake system upgrades by writing to the /data/vendor/upgrage folder.
References
cve@mitre.orghttps://github.com/sickcodes/security/blob/master/advisories/SICK-2020-012.mdExploit, Third Party Advisory
cve@mitre.orghttps://github.com/sickcodes/security/blob/master/etc/CVE-2020-27403_CVE-2020-28055_GlobalFAQ.pdfThird Party Advisory
cve@mitre.orghttps://github.com/sickcodes/security/blob/master/etc/CVE-2020-27403_CVE-2020-28055_Press-Statement-and-Questions_11162020.pdfThird Party Advisory
cve@mitre.orghttps://securityledger.com/2020/11/security-holes-opened-back-door-to-tcl-android-smart-tvs/Third Party Advisory
cve@mitre.orghttps://securityledger.com/2020/11/tv-maker-tcl-denies-back-door-promises-better-process/Third Party Advisory
cve@mitre.orghttps://sick.codes/extraordinary-vulnerabilities-discovered-in-tcl-android-tvs-now-worlds-3rd-largest-tv-manufacturer/Exploit, Third Party Advisory
cve@mitre.orghttps://sick.codes/sick-2020-012Exploit, Third Party Advisory
cve@mitre.orghttps://support.tcl.com/vulnerabilities-found-in-tcl-android-tvsVendor Advisory
cve@mitre.orghttps://twitter.com/johnjhacking/Third Party Advisory
cve@mitre.orghttps://twitter.com/sickcodes/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/sickcodes/security/blob/master/advisories/SICK-2020-012.mdExploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/sickcodes/security/blob/master/etc/CVE-2020-27403_CVE-2020-28055_GlobalFAQ.pdfThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/sickcodes/security/blob/master/etc/CVE-2020-27403_CVE-2020-28055_Press-Statement-and-Questions_11162020.pdfThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://securityledger.com/2020/11/security-holes-opened-back-door-to-tcl-android-smart-tvs/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://securityledger.com/2020/11/tv-maker-tcl-denies-back-door-promises-better-process/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://sick.codes/extraordinary-vulnerabilities-discovered-in-tcl-android-tvs-now-worlds-3rd-largest-tv-manufacturer/Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://sick.codes/sick-2020-012Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://support.tcl.com/vulnerabilities-found-in-tcl-android-tvsVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://twitter.com/johnjhacking/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://twitter.com/sickcodes/Third Party Advisory
Impacted products
Vendor Product Version
tcl 32s330_firmware *
tcl 32s330 -
tcl 40s330_firmware *
tcl 40s330 -
tcl 43s434_firmware *
tcl 43s434 -
tcl 50s434_firmware *
tcl 50s434 -
tcl 55s434_firmware *
tcl 55s434 -
tcl 65s434_firmware *
tcl 65s434 -
tcl 75s434_firmware *
tcl 75s434 -
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:tcl:32s330_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F8917F66-D6DD-4592-B426-2D732B20F9EB",
              "versionEndExcluding": "v8-r851t10-lf1v091",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:tcl:32s330:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "56FE475B-9E0B-4CEB-ACE7-12298F24EA44",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:tcl:40s330_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D80F9316-673A-418B-B235-EB07256BEDC6",
              "versionEndExcluding": "v8-r851t10-lf1v091",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:tcl:40s330:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8E20B7CC-7A75-4881-ACC8-1823C7FA0075",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:tcl:43s434_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4B3CEA71-8A14-49F8-9DD1-998FFA8D9083",
              "versionEndExcluding": "v8-r851t02-lf1v440",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:tcl:43s434:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F7EDDFE1-4794-4FEB-9505-08EC4CE2E7DE",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:tcl:50s434_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A35187E7-A0E1-48B4-8528-2D9A0126C950",
              "versionEndExcluding": "v8-r851t02-lf1v440",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:tcl:50s434:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "369146B4-AA84-4997-8E92-5E651E402317",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:tcl:55s434_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C5EDE7A1-9426-4C8A-9031-F0F30E6E882E",
              "versionEndExcluding": "v8-r851t02-lf1v440",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:tcl:55s434:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "FDD2D6D3-CA5D-48CA-9B31-01225E395858",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:tcl:65s434_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "25A8C850-0968-4DF4-B795-48EADD4DB197",
              "versionEndExcluding": "v8-r851t02-lf1v440",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:tcl:65s434:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A807F653-170F-4819-B378-0BF2F841CEC2",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:tcl:75s434_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "757EBB9A-4404-4B07-BAFA-8502BE5942A4",
              "versionEndExcluding": "v8-r851t02-lf1v440",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:tcl:75s434:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B2E147C9-2EEE-468A-96B2-1EAFCEF0D917",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in the TCL Android Smart TV series V8-R851T02-LF1 V295 and below and V8-T658T01-LF1 V373 and below by TCL Technology Group Corporation allows a local unprivileged attacker, such as a malicious App, to read \u0026 write to the /data/vendor/tcl, /data/vendor/upgrade, and /var/TerminalManager directories within the TV file system. An attacker, such as a malicious APK or local unprivileged user could perform fake system upgrades by writing to the /data/vendor/upgrage folder."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en la serie TCL Android Smart TV V8-R851T02-LF1 versiones V295 y por debajo y V8-T658T01-LF1 versiones V373 y por debajo de TCL Technology Group Corporation, permite a un atacante local no privilegiado, tal y como una aplicaci\u00f3n maliciosa, leer y escribir en /data/vendor/tcl, /data/vendor/upgrade y /var/TerminalManager dentro del sistema de archivos del TV.\u0026#xa0;Un atacante, como un APK malicioso o un usuario local no privilegiado, podr\u00eda llevar a cabo actualizaciones del sistema falsas al escribir en la carpeta /data/vendor/upgrade"
    }
  ],
  "id": "CVE-2020-28055",
  "lastModified": "2026-06-17T03:10:04.897",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 7.2,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-11-10T18:15:12.137",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://github.com/sickcodes/security/blob/master/advisories/SICK-2020-012.md"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/sickcodes/security/blob/master/etc/CVE-2020-27403_CVE-2020-28055_GlobalFAQ.pdf"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/sickcodes/security/blob/master/etc/CVE-2020-27403_CVE-2020-28055_Press-Statement-and-Questions_11162020.pdf"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://securityledger.com/2020/11/security-holes-opened-back-door-to-tcl-android-smart-tvs/"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://securityledger.com/2020/11/tv-maker-tcl-denies-back-door-promises-better-process/"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://sick.codes/extraordinary-vulnerabilities-discovered-in-tcl-android-tvs-now-worlds-3rd-largest-tv-manufacturer/"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://sick.codes/sick-2020-012"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://support.tcl.com/vulnerabilities-found-in-tcl-android-tvs"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://twitter.com/johnjhacking/"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://twitter.com/sickcodes/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://github.com/sickcodes/security/blob/master/advisories/SICK-2020-012.md"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/sickcodes/security/blob/master/etc/CVE-2020-27403_CVE-2020-28055_GlobalFAQ.pdf"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/sickcodes/security/blob/master/etc/CVE-2020-27403_CVE-2020-28055_Press-Statement-and-Questions_11162020.pdf"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://securityledger.com/2020/11/security-holes-opened-back-door-to-tcl-android-smart-tvs/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://securityledger.com/2020/11/tv-maker-tcl-denies-back-door-promises-better-process/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://sick.codes/extraordinary-vulnerabilities-discovered-in-tcl-android-tvs-now-worlds-3rd-largest-tv-manufacturer/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://sick.codes/sick-2020-012"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://support.tcl.com/vulnerabilities-found-in-tcl-android-tvs"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://twitter.com/johnjhacking/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://twitter.com/sickcodes/"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-732"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.