CVE-2020-28055: n/a vulnerability

CVE-2020-28055: A vulnerability in the TCL Android Smart TV series V8-R851T02-LF1 V295 and below and V8-T658T01-LF1 V373 an...

A vulnerability in the TCL Android Smart TV series V8-R851T02-LF1 V295 and below and V8-T658T01-LF1 V373 and below by TCL Technology Group Corporation allows a local unprivileged attacker, such as a malicious App, to read & write to the /data/vendor/tcl, /data/vendor/upgrade, and /var/TerminalManager directories within the TV file system. An attacker, such as a malicious APK or local unprivileged user could perform fake system upgrades by writing to the /data/vendor/upgrage folder.

UnknownCVSS not scoredNot KEV-listedUpdatedAug 4, 2024, 16:33 UTC (UTC+00:00)

Security readout for executives and security teams

Plain-English summary

Certain TCL Android Smart TVs allowed a local unprivileged user or malicious app to read and write sensitive vendor and upgrade directories. The business risk is device tampering, including fake upgrade activity. The provided record does not include CVSS, CWE, or confirmed active exploitation.

Executive priority

Treat this as a targeted device-integrity issue, not a confirmed enterprise-wide emergency. Prioritize environments where TCL Android TVs share networks with sensitive systems, display trusted content, or allow app installation by non-admin users.

Technical view

CVE-2020-28055 affects TCL Android Smart TV firmware V8-R851T02-LF1 V295 and below, and V8-T658T01-LF1 V373 and below. A local unprivileged attacker can read and write /data/vendor/tcl, /data/vendor/upgrade, and /var/TerminalManager, enabling unauthorized modification of upgrade-related filesystem paths.

Likely exposure

Exposure is limited to affected TCL Android Smart TV models and firmware versions where an attacker can run code locally, such as through a malicious APK or local unprivileged account. Internet-only exposure is not supported by the provided CVE text.

Exploitation context

The CVE describes local exploitation by a malicious app or local unprivileged user. The source bundle marks CISA KEV as false and provides no cited evidence of active exploitation in the wild.

Researcher notes

Evidence is incomplete: NVD-style severity, CVSS, CWE, and exact patched versions are not present in the bundle. The key technical claim is local unprivileged read/write access to vendor and upgrade directories, with fake upgrade activity described as a possible outcome.

Mitigation direction

Inventory TCL Android Smart TVs and record exact firmware build identifiers.
Check TCL support guidance for fixed firmware or vendor-approved remediation.
Restrict sideloading and installation of untrusted APKs on affected TVs.
Remove unsupported or unmanaged affected devices from sensitive environments.
Monitor vendor advisories before assuming a complete fix path.

Validation and detection

Confirm whether firmware is V8-R851T02-LF1 V295 or below.
Confirm whether firmware is V8-T658T01-LF1 V373 or below.
Review device management records for sideloaded or untrusted apps.
Check whether affected filesystem paths are writable by unprivileged local contexts.
Document any compensating controls limiting local app execution.

Prepared: Jun 5, 2026, 13:31 UTC (UTC+00:00)
Confidence: medium
Sources: 8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2020-28055 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup

Vulnerability profileCVE Program record

Severity: Unknown
CVSS: Not scored
Known Exploited: No
Published: Nov 10, 2020, 17:53 UTC (UTC+00:00)

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors

0Timeline events

0ADP providers

11Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

CVE List V5 sourceCVE List V5
https://twitter.com/sickcodes/CVE reference · x_refsource_MISC
https://twitter.com/johnjhacking/CVE reference · x_refsource_MISC
https://sick.codes/extraordinary-vulnerabilities-discovered-in-tcl-android-tvs-now-worlds-3rd-largest-tv-manufacturer/CVE reference · x_refsource_MISC
https://github.com/sickcodes/security/blob/master/advisories/SICK-2020-012.mdCVE reference · x_refsource_MISC
https://sick.codes/sick-2020-012CVE reference · x_refsource_MISC
https://github.com/sickcodes/security/blob/master/etc/CVE-2020-27403_CVE-2020-28055_Press-Statement-and-Questions_11162020.pdfCVE reference · x_refsource_MISC
https://github.com/sickcodes/security/blob/master/etc/CVE-2020-27403_CVE-2020-28055_GlobalFAQ.pdfCVE reference · x_refsource_MISC
https://securityledger.com/2020/11/security-holes-opened-back-door-to-tcl-android-smart-tvs/CVE reference · x_refsource_MISC
https://securityledger.com/2020/11/tv-maker-tcl-denies-back-door-promises-better-process/CVE reference · x_refsource_MISC
https://support.tcl.com/vulnerabilities-found-in-tcl-android-tvsCVE reference · x_refsource_MISC

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus

n/an/an/aListed

Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.