Amazon Fire TV Cube Rooted Using Four-Year-Old Arm Mali Vulnerability
Arm Mali GPU vulnerability allows rooting of Amazon Fire TV Cube.
Run Amazon?
Get an email when a reviewed story names Amazon, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
A four-year-old vulnerability in Arm's Mali GPU driver, CVE-2022-38181, has been leveraged to gain root access on the third-generation Amazon Fire TV Cube. This allows users to bypass Amazon's software restrictions and install alternative operating systems like CoreELEC or EmuELEC. Amazon states the exploit requires physical access and deliberate modification, posing minimal risk to customers.
The lesson from this incident
Full lessonA vulnerability in Arm's Mali GPU driver (CVE-2022-38181), disclosed in 2022, remained unpatched on Amazon's third-generation Fire TV Cube long enough to be weaponized for root access. This highlights the persistent danger of unpatched firmware in consumer IoT and embedded devices, where vendor patch cadences often lag behind public vulnerability disclosures. While Amazon notes physical access is required — limiting broad exploitation risk — the four-year gap between vulnerability disclosure and exploitation underscores that IoT manufacturers must treat firmware patching with the same urgency applied to enterprise software. Organizations and consumers who rely on smart devices should understand that delayed patching windows, even on 'low-risk' endpoints, can compound into significant security gaps over time.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
Indicators of Compromise
- cve — CVE-2022-38181