PT-2020-16915 · Tcl · Tcl Android Smart Tv

Johnjhacking + 1 · Published 2020-11-10 · Updated 2026-02-19 · CVE-2020-28055

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TCL Android Smart TV series V8-R851T02-LF1 versions V295 and below TCL Android Smart TV series V8-T658T01-LF1 versions V373 and below

Description A local unprivileged attacker, such as a malicious App, can read and write to the /data/vendor/tcl, /data/vendor/upgrade, and /var/TerminalManager directories within the TV file system. This allows an attacker, such as a malicious APK or local unprivileged user, to perform fake system upgrades by writing to the /data/vendor/upgrade folder.

Recommendations For TCL Android Smart TV series V8-R851T02-LF1 versions V295 and below: consider restricting access to the /data/vendor/tcl, /data/vendor/upgrade, and /var/TerminalManager directories to prevent unauthorized read and write operations. For TCL Android Smart TV series V8-T658T01-LF1 versions V373 and below: consider restricting access to the /data/vendor/tcl, /data/vendor/upgrade, and /var/TerminalManager directories to prevent unauthorized read and write operations. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2020-28055

Affected Products

Tcl Android Smart Tv

References · 14

• 🔥 https://github.com/sickcodes/security/blob/master/advisories/SICK-2020-012.md · Exploit
• 🔥 https://github.com/sickcodes/security/blob/master/etc/CVE-2020-27403_CVE-2020-28055_GlobalFAQ.pdf · Exploit
• 🔥 https://github.com/sickcodes/security/blob/master/etc/CVE-2020-27403_CVE-2020-28055_Press-Statement-and-Questions_11162020.pdf · Exploit
• 🔥 https://sick.codes/sick-2020-012 · Exploit
• 🔥 https://sick.codes/extraordinary-vulnerabilities-discovered-in-tcl-android-tvs-now-worlds-3rd-largest-tv-manufacturer · Exploit
• https://support.tcl.com/vulnerabilities-found-in-tcl-android-tvs · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-28055 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-28055 · Security Note
• https://t.me/cibsecurity/16106 · Telegram Post
• https://securityledger.com/2020/11/tv-maker-tcl-denies-back-door-promises-better-process · Note
• https://securityledger.com/2020/11/security-holes-opened-back-door-to-tcl-android-smart-tvs · Note
• https://twitter.com/sickcodes · Note
• https://twitter.com/johnjhacking · Note
• https://twitter.com/grok/status/2024323310155104307 · Twitter Post