CVE-2020-28055: Tcl 32s330 Firmware

High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days.

A vulnerability in the TCL Android Smart TV series V8-R851T02-LF1 V295 and below and V8-T658T01-LF1 V373 and below by TCL Technology Group Corporation allows a local unprivileged attacker, such as a malicious App, to read & write to the /data/vendor/tcl, /data/vendor/upgrade, and /var/TerminalManager directories within the TV file system. An attacker, such as a malicious APK or local unprivileged user could perform fake system upgrades by writing to the /data/vendor/upgrage folder.

Affected products

• Tcl 32s330 Firmware: before v8-r851t10-lf1v091 (fixed in v8-r851t10-lf1v091)
• Tcl 40s330 Firmware: before v8-r851t10-lf1v091 (fixed in v8-r851t10-lf1v091)
• Tcl 43s434 Firmware: before v8-r851t02-lf1v440 (fixed in v8-r851t02-lf1v440)
• Tcl 50s434 Firmware: before v8-r851t02-lf1v440 (fixed in v8-r851t02-lf1v440)
• Tcl 55s434 Firmware: before v8-r851t02-lf1v440 (fixed in v8-r851t02-lf1v440)
• Tcl 65s434 Firmware: before v8-r851t02-lf1v440 (fixed in v8-r851t02-lf1v440)
• Tcl 75s434 Firmware: before v8-r851t02-lf1v440 (fixed in v8-r851t02-lf1v440)

Published 2020-11-10. Last modified 2026-06-17.