CVE-2020-28055 Overview
CVE-2020-28055 is an insecure permissions vulnerability affecting TCL Android Smart TV series devices with firmware versions V8-R851T02-LF1 V295 and below, as well as V8-T658T01-LF1 V373 and below. The vulnerability allows a local unprivileged attacker, such as a malicious Android application installed on the TV, to read and write to sensitive system directories including /data/vendor/tcl, /data/vendor/upgrade, and /var/TerminalManager within the TV's file system.
This vulnerability is particularly concerning because it enables attackers to perform fake system upgrades by writing malicious content to the /data/vendor/upgrade folder, potentially leading to persistent compromise of the device.
Critical Impact
Local attackers can read and write to sensitive system directories, enabling fake firmware upgrades and persistent device compromise on millions of TCL Smart TVs worldwide.
Affected Products
- TCL 32S330 and 32S330 Firmware
- TCL 40S330 and 40S330 Firmware
- TCL 43S434 and 43S434 Firmware
- TCL 50S434 and 50S434 Firmware
- TCL 55S434 and 55S434 Firmware
- TCL 65S434 and 65S434 Firmware
- TCL 75S434 and 75S434 Firmware
Discovery Timeline
- November 10, 2020 - CVE-2020-28055 published to NVD
- November 21, 2024 - Last updated in NVD database
Technical Details for CVE-2020-28055
Vulnerability Analysis
This vulnerability stems from improper permission configurations (CWE-732: Incorrect Permission Assignment for Critical Resource) in TCL Android Smart TV firmware. The affected devices expose critical system directories with overly permissive access controls, allowing any application running on the device—regardless of privilege level—to read and write to sensitive file system locations.
The vulnerable directories include /data/vendor/tcl which contains vendor-specific configuration data, /data/vendor/upgrade which handles system firmware updates, and /var/TerminalManager which manages terminal operations. When an unprivileged application gains write access to the upgrade directory, it can inject malicious firmware packages that the TV will process as legitimate updates during the next update cycle.
The local attack vector requires the attacker to have code execution on the device, which can be achieved through a malicious application installed from the Google Play Store or sideloaded onto the TV. Once installed, the malicious app can exploit these insecure permissions without requiring any additional user interaction.
Root Cause
The root cause of CVE-2020-28055 is improper file system permission assignment in TCL's Android TV firmware. The directories /data/vendor/tcl, /data/vendor/upgrade, and /var/TerminalManager are configured with world-readable and world-writable permissions, violating the principle of least privilege. This allows any process running on the device, including unprivileged third-party applications, to access and modify these sensitive system directories that should only be accessible by privileged system processes.
Attack Vector
The attack requires local access to the device, typically achieved through a malicious Android application. The attack flow involves the following:
- An attacker develops a malicious Android application that targets TCL Smart TVs
- The user installs the application on their TCL TV (either from an app store or via sideloading)
- The malicious app exploits the insecure directory permissions to write to /data/vendor/upgrade
- The attacker plants a fake system upgrade package in the upgrade directory
- When the TV processes the update, the malicious firmware is installed, granting persistent access
The vulnerability does not require elevated privileges, and the malicious application does not need any special Android permissions beyond basic file system access to exploit this flaw.
Detection Methods for CVE-2020-28055
Indicators of Compromise
- Unexpected files or modifications in /data/vendor/tcl, /data/vendor/upgrade, or /var/TerminalManager directories
- Unusual applications installed on TCL Smart TVs that were not intentionally downloaded by the user
- Firmware version mismatches or unexpected system update notifications
- Anomalous network traffic from the Smart TV to unknown external servers
Detection Strategies
- Monitor file integrity of sensitive system directories on TCL Android TV devices for unauthorized modifications
- Review installed applications on TCL Smart TVs and remove any unrecognized or suspicious apps
- Compare current firmware versions against official TCL firmware releases to detect tampering
- Implement network monitoring to detect unusual outbound connections from Smart TV devices
Monitoring Recommendations
- Enable logging for file system access events on Android TV devices where possible
- Segment IoT devices including Smart TVs on separate network VLANs with restricted internet access
- Regularly audit installed applications on all connected Smart TV devices in the organization
- Monitor TCL's security advisories for updated firmware releases and patch announcements
How to Mitigate CVE-2020-28055
Immediate Actions Required
- Update TCL Smart TV firmware to the latest version available from TCL Support
- Audit and remove any unnecessary or suspicious applications installed on affected TCL Smart TVs
- Restrict network access for Smart TVs to prevent remote exploitation staging
- Consider factory reset of potentially compromised devices after updating firmware
Patch Information
TCL Technology Group Corporation has acknowledged the vulnerability and released firmware updates to address the insecure permission issues. Users should visit the TCL Support Vulnerability Report to obtain the latest firmware updates for their specific TV model.
For detailed technical information about this vulnerability, refer to the GitHub Security Advisory SICK-2020-012 and the comprehensive analysis at Sick Codes.
Workarounds
- Avoid installing applications from unknown or untrusted sources on TCL Smart TVs
- Disable automatic application installation features if available in TV settings
- Isolate Smart TV devices on a separate network segment with restricted access
- Monitor network traffic from the TV for suspicious outbound connections to unknown hosts
# Network isolation example using firewall rules
# Restrict Smart TV outbound access to essential services only
iptables -A FORWARD -s <TCL_TV_IP> -d 0.0.0.0/0 -j DROP
iptables -A FORWARD -s <TCL_TV_IP> -d <ALLOWED_UPDATE_SERVER> -j ACCEPT
iptables -A FORWARD -s <TCL_TV_IP> -d <STREAMING_SERVICE_IPS> -j ACCEPT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
