CVE-2026-78745 — Remote Code Execution via Android Debug Bridge (ADB)

CVE-2026-78745 affects HiDPT / Weyon HiDPTAndroid devices using the Hi3751V350 and Hi3751V352E_DMO platforms. The vulnerability allows a remote attacker to execute arbitrary code through the Android Debug Bridge (adbd) daemon.

Overview

During independent security research, I identified a vulnerability affecting the Android Debug Bridge (ADB) service on HiDPT / Weyon HiDPTAndroid devices.

The ADB service was exposed remotely and could be accessed without the level of restriction expected for a privileged administrative interface. During testing, the resulting ADB session was found to be running with root-level privileges.

The vulnerability was reported to the vendor and later submitted to MITRE for CVE assignment. It was assigned CVE-2026-78745 and publicly disclosed following the CVE assignment.

Affected Products

Affected component: Android Debug Bridge daemon (adbd)

Technical Details

The vulnerability is related to the remote exposure of the Android Debug Bridge service on affected devices.

ADB is a powerful Android interface commonly used for development, debugging, and device administration. Because it provides privileged access to the underlying system, it should normally be protected from unauthorized remote access.

During testing, the ADB service could be reached remotely and an ADB session was established on the affected device. I then verified the privilege level under which the session was operating.

The verification returned:

root

This confirmed that the ADB session was running with root-level privileges.

The combination of remotely accessible ADB and root-level execution creates a path to arbitrary code execution on the affected device.

Impact

An attacker able to reach the exposed ADB service may be able to execute arbitrary code on an affected device.

Because the ADB session operates with root-level privileges, successful exploitation could provide extensive access to the underlying Android environment. The actual impact will depend on the device's configuration, enabled services, and the network in which it is deployed.

Discovery and Reporting

I discovered the vulnerability on 26 May 2026 during independent security research.

The vulnerability was reported to the affected vendor on the same day. No response or acknowledgement was received from the vendor following the report.

On 8 June 2026, I submitted the vulnerability to MITRE for CVE assignment.

MITRE subsequently assigned CVE-2026-78745 on 2 September 2026.

Vendor Response

The affected vendor was notified on 26 May 2026.

No response or acknowledgement had been received from the vendor at the time of public disclosure.

Disclosure Timeline

Mitigation

Until a vendor-provided fix or updated firmware is available, users of affected devices should consider the following measures:

• Restrict access to the ADB service to trusted systems and networks.
• Disable ADB when it is not required.
• Avoid exposing ADB to untrusted or public networks.
• Use network segmentation to isolate affected devices from untrusted systems.
• Apply vendor-provided firmware and security updates when available.

Security Considerations

ADB provides powerful administrative capabilities and should be treated as a sensitive service.

Organizations deploying affected devices should review their network configuration and determine whether ADB is accessible from unintended network segments. Where ADB is required, access should be limited to authorized systems and trusted networks.

CVE Information

References

• CVE-2026-78745
• MITRE CVE Program

Researcher

n0c71v3x