CVE-2026-36027: Code27 Companion Hub RCE Vulnerability

CVE-2026-36027 Overview

CVE-2026-36027 affects Code27 Companion Hub build SQ3A.220705.003.A1. The vulnerability permits a physically proximate attacker to execute arbitrary code through the USB debugging (ADB) and Android Debug Bridge components. The weakness maps to CWE-1313: Hardware Allows Activation of User-controlled Device Debugging Interfaces.

Exploitation requires physical access to the target device but does not require authentication or user interaction. Successful exploitation compromises confidentiality, integrity, and availability of the affected device.

Critical Impact
A physically proximate attacker with a USB connection can execute arbitrary code on the device by leveraging the exposed ADB interface, gaining full control over device data and functionality.

Affected Products

Code27 Companion Hub firmware build SQ3A.220705.003.A1
Android Debug Bridge (ADB) component on the affected build
USB debugging interface on the affected device

Discovery Timeline

2026-07-08 - CVE-2026-36027 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-36027

Vulnerability Analysis

The flaw resides in the way Code27 Companion Hub build SQ3A.220705.003.A1 exposes the Android Debug Bridge over USB. When ADB is reachable on a physically connected host, an attacker can issue debugging commands that execute arbitrary code within the device context. This class of issue is tracked as [CWE-1313], covering hardware that permits activation of user-controlled debugging interfaces without adequate protection.

Because the interface is enabled and reachable at the hardware level, no software credential is required beyond the physical USB connection. The attacker interacts with the device using standard ADB tooling to spawn shells, install packages, push files, and elevate access to sensitive resources.

Root Cause

The root cause is insufficient restriction of the debugging interface on production firmware. The SQ3A.220705.003.A1 build ships with ADB pathways accessible over USB in a state that permits command execution to a locally attached host. Debug transports intended for development are not adequately gated by authentication, user consent, or hardware fusing on shipped devices.

Attack Vector

The attack vector is physical. An attacker connects a controlled host to the device using a USB cable and interacts with the exposed ADB endpoint. From there, the attacker can push executables, launch shell commands, read protected storage, or persist code that survives reboots. No network exposure is required, and the interaction is opaque to remote monitoring solutions unless local telemetry captures USB device events. Proof-of-concept material referenced in the GitHub Exploits Repository demonstrates command execution against affected builds.

Detection Methods for CVE-2026-36027

Indicators of Compromise

Unexpected adbd process activity or ADB shell sessions on devices running build SQ3A.220705.003.A1
New USB host enumeration events on devices deployed in physically exposed locations such as kiosks, lobbies, or shared workspaces
Installation of unsigned APKs, sideloaded binaries, or files written to /data/local/tmp outside of provisioning windows
Modifications to boot scripts, init.rc fragments, or persistence locations following a physical support event

Detection Strategies

Inventory devices running Code27 Companion Hub build SQ3A.220705.003.A1 and flag any with USB debugging enabled
Correlate physical access logs from facilities with device event timestamps to identify unauthorized USB sessions
Baseline expected ADB usage for authorized administrators and alert on deviations
Monitor for new package installations or filesystem changes that originate outside management channels

Monitoring Recommendations

Enable and forward device syslog and package manager events to a central log store for retention and search
Alert on any transition of the ADB state from disabled to enabled on production units
Track USB host connection events and pair them with the identity of the connected workstation where possible
Review physical security logs and tamper indicators for devices deployed in unattended environments

How to Mitigate CVE-2026-36027

Immediate Actions Required

Disable USB debugging on all devices running Code27 Companion Hub build SQ3A.220705.003.A1 until a fixed build is available
Restrict physical access to affected devices through locked enclosures, cable locks, or port blockers
Remove or revoke any pre-authorized ADB host keys stored on the devices
Audit devices for signs of prior ADB access, including unexpected packages, shell history, or filesystem artifacts

Patch Information

No vendor patch reference is available in the NVD entry for CVE-2026-36027 at the time of publication. Consult the Code27 Resource Page and the Code.com Overview for future firmware updates. Apply any successor build that supersedes SQ3A.220705.003.A1 as soon as it is released by the vendor.

Workarounds

Physically block or disable the USB data lines on deployed devices using USB port blockers or data-blocking adapters
Deploy devices only in physically secured locations with monitored access
Enforce ADB host key authentication and remove unknown keys from ~/.android/adbkey.pub equivalents on the device
Set the device ADB service to require explicit user confirmation on every new host connection where the platform supports it

bash

# Verify and disable ADB where supported
adb devices
adb shell settings put global adb_enabled 0
adb shell settings put global development_settings_enabled 0