Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2020-28055 Details

Description

A vulnerability in the TCL Android Smart TV series V8-R851T02-LF1 V295 and below and V8-T658T01-LF1 V373 and below by TCL Technology Group Corporation allows a local unprivileged attacker, such as a malicious App, to read & write to the /data/vendor/tcl, /data/vendor/upgrade, and /var/TerminalManager directories within the TV file system. An attacker, such as a malicious APK or local unprivileged user could perform fake system upgrades by writing to the /data/vendor/upgrage folder.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:7.8 HIGHVector:CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/sickcodes/security/blob/master/advisories/SICK-2020-012.md	CVE	ExploitThird Party Advisory
https://github.com/sickcodes/security/blob/master/etc/CVE-2020-27403_CVE-2020-28055_GlobalFAQ.pdf	CVE	Third Party Advisory
https://github.com/sickcodes/security/blob/master/etc/CVE-2020-27403_CVE-2020-28055_Press-Statement-and-Questions_11162020.pdf	CVE	Third Party Advisory
https://securityledger.com/2020/11/security-holes-opened-back-door-to-tcl-android-smart-tvs/	CVE	Third Party Advisory
https://securityledger.com/2020/11/tv-maker-tcl-denies-back-door-promises-better-process/	CVE	Third Party Advisory
https://sick.codes/extraordinary-vulnerabilities-discovered-in-tcl-android-tvs-now-worlds-3rd-largest-tv-manufacturer/	CVE	ExploitThird Party Advisory
https://sick.codes/sick-2020-012	CVE	ExploitThird Party Advisory
https://support.tcl.com/vulnerabilities-found-in-tcl-android-tvs	CVE	Vendor Advisory
https://twitter.com/johnjhacking/	CVE	Third Party Advisory
https://twitter.com/sickcodes/	CVE	Third Party Advisory
https://github.com/sickcodes/security/blob/master/advisories/SICK-2020-012.md	[email protected]	ExploitThird Party Advisory
https://github.com/sickcodes/security/blob/master/etc/CVE-2020-27403_CVE-2020-28055_GlobalFAQ.pdf	[email protected]	Third Party Advisory
https://github.com/sickcodes/security/blob/master/etc/CVE-2020-27403_CVE-2020-28055_Press-Statement-and-Questions_11162020.pdf	[email protected]	Third Party Advisory
https://securityledger.com/2020/11/security-holes-opened-back-door-to-tcl-android-smart-tvs/	[email protected]	Third Party Advisory
https://securityledger.com/2020/11/tv-maker-tcl-denies-back-door-promises-better-process/	[email protected]	Third Party Advisory
https://sick.codes/extraordinary-vulnerabilities-discovered-in-tcl-android-tvs-now-worlds-3rd-largest-tv-manufacturer/	[email protected]	ExploitThird Party Advisory
https://sick.codes/sick-2020-012	[email protected]	ExploitThird Party Advisory
https://support.tcl.com/vulnerabilities-found-in-tcl-android-tvs	[email protected]	Vendor Advisory
https://twitter.com/johnjhacking/	[email protected]	Third Party Advisory
https://twitter.com/sickcodes/	[email protected]	Third Party Advisory

see all 20 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-732	Incorrect Permission Assignment for Critical Resource	[email protected]

Affected Products

Product	Versions
tcl 32s330 firmware	< v8-r851t10-lf1v091
CPE cpe:2.3:o:tcl:32s330_firmware:::::::: Remediation No remediation found in references.
tcl 32s330	All versions
CPE cpe:2.3:h:tcl:32s330:-:::::::* Remediation No remediation found in references.
tcl 40s330 firmware	< v8-r851t10-lf1v091
CPE cpe:2.3:o:tcl:40s330_firmware:::::::: Remediation No remediation found in references.
tcl 40s330	All versions
CPE cpe:2.3:h:tcl:40s330:-:::::::* Remediation No remediation found in references.
tcl 43s434 firmware	< v8-r851t02-lf1v440
CPE cpe:2.3:o:tcl:43s434_firmware:::::::: Remediation No remediation found in references.
tcl 43s434	All versions
CPE cpe:2.3:h:tcl:43s434:-:::::::* Remediation No remediation found in references.
tcl 50s434 firmware	< v8-r851t02-lf1v440
CPE cpe:2.3:o:tcl:50s434_firmware:::::::: Remediation No remediation found in references.
tcl 50s434	All versions
CPE cpe:2.3:h:tcl:50s434:-:::::::* Remediation No remediation found in references.
tcl 55s434 firmware	< v8-r851t02-lf1v440
CPE cpe:2.3:o:tcl:55s434_firmware:::::::: Remediation No remediation found in references.
tcl 55s434	All versions
CPE cpe:2.3:h:tcl:55s434:-:::::::* Remediation No remediation found in references.
tcl 65s434 firmware	< v8-r851t02-lf1v440
CPE cpe:2.3:o:tcl:65s434_firmware:::::::: Remediation No remediation found in references.
tcl 65s434	All versions
CPE cpe:2.3:h:tcl:65s434:-:::::::* Remediation No remediation found in references.
tcl 75s434 firmware	< v8-r851t02-lf1v440
CPE cpe:2.3:o:tcl:75s434_firmware:::::::: Remediation No remediation found in references.
tcl 75s434	All versions
CPE cpe:2.3:h:tcl:75s434:-:::::::* Remediation No remediation found in references.

Change History

5 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	[email protected]
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Dec 8, 2020	Initial Analysis	[email protected]
Dec 7, 2020	CVE Modified	[email protected]

CVE-2020-28055 Details

Description

Metrics

References to Advisories, Solutions, and Tools

Weakness Enumeration

Affected Products

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

Change History

QUICK INFO