CVE-2026-78745: HiDPT Android Hi3751V350 ADB RCE Vulnerability

CVE-2026-78745 Overview

CVE-2026-78745 affects the HiDPT/Weyon HiDPTAndroid Hi3751V350 (Hi3751V352E_DMO) platform. The vulnerability exposes the Android Debug Bridge daemon (adbd) to network-based attackers. A remote adversary can connect to the exposed ADB service and execute arbitrary commands without authentication. The flaw maps to CWE-284: Improper Access Control and carries a network-reachable attack vector with no user interaction required.

Critical Impact
An unauthenticated remote attacker with network access to the affected device can execute arbitrary code, install persistent implants, and pivot into adjacent network segments.

Affected Products

HiDPT/Weyon HiDPTAndroid Hi3751V350
HiDPT/Weyon Hi3751V352E_DMO firmware
Devices manufactured on the Hi3751V350 SoC platform running the affected HiDPTAndroid build

Discovery Timeline

2026-09-04 - CVE-2026-78745 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD

Technical Details for CVE-2026-78745

Vulnerability Analysis

The Android Debug Bridge daemon (adbd) provides a developer interface to Android devices. It supports shell command execution, file transfer, and process attachment. On production consumer devices, adbd should be disabled or restricted to USB transport only.

The affected HiDPTAndroid firmware ships with adbd listening on TCP port 5555 without authentication. Any host on the same network segment can issue an adb connect command against the device address. Once connected, the attacker gains shell access with the privileges of the ADB service, typically the shell user with broad system access.

This exposure violates the trust model that Android establishes for the debug bridge. On modern Android releases, ADB over TCP requires user acknowledgment through the RSA public key confirmation dialog. The affected firmware bypasses that safeguard, granting immediate access on connect.

Root Cause

The root cause is improper access control on the ADB transport. The vendor build enables TCP transport by default and omits the authentication handshake that gates command execution. See the GitHub PoC repository for reproduction details.

Attack Vector

An attacker on the local network scans for TCP port 5555, connects using the standard adb client, and issues shell commands. From the shell, the attacker can read application data, install packages, modify system properties, and stage secondary payloads. No credentials, tokens, or user interaction are required.

Refer to the GitHub PoC repository for the published proof-of-concept methodology.

Detection Methods for CVE-2026-78745

Indicators of Compromise

Inbound or outbound TCP connections on port 5555 involving affected device IP addresses
Unexpected adbd process activity or adb connect traffic patterns on the LAN
New APK installations, modified system properties, or unfamiliar shell processes on the device
Presence of unknown ADB RSA public keys in /data/misc/adb/adb_keys

Detection Strategies

Perform periodic network scans for hosts responding on TCP/5555 with the ADB banner
Correlate device inventory against firmware versions carrying the Hi3751V352E_DMO build
Monitor DNS and connection telemetry for adb-family user agents originating inside the network

Monitoring Recommendations

Enable network flow logging on segments that host smart TV and embedded Android devices
Alert on any new listener on TCP/5555 discovered during scheduled asset scans
Log firmware and configuration changes on managed display and IoT endpoints

How to Mitigate CVE-2026-78745

Immediate Actions Required

Isolate affected Hi3751V350-based devices on a segmented VLAN with no route to sensitive systems
Block inbound TCP/5555 at network boundaries and between user and IoT segments
Inventory all HiDPTAndroid devices and confirm firmware versions against vendor advisories
Contact the vendor via the WeyonTV homepage for firmware guidance

Patch Information

No vendor patch is listed in the NVD entry at the time of publication. Administrators should track vendor communications through the WeyonTV homepage and apply firmware updates when they become available.

Workarounds

Disable ADB over TCP on the device where the firmware exposes the option
Enforce network access control lists that drop traffic to TCP/5555 on affected subnets
Place vulnerable devices behind a firewall that permits only whitelisted management traffic
Remove devices from production networks if firmware cannot be updated or ADB cannot be disabled

bash

# Example firewall rule to block ADB over TCP at the network boundary
iptables -A FORWARD -p tcp --dport 5555 -j DROP
iptables -A INPUT   -p tcp --dport 5555 -j DROP