Amazon Fire TV Cube Security Flaws Allow Bootloader Unlocking and Permanent Root Access

A recently released exploit package lets the third-generation Amazon Fire TV Cube gain an unlocked bootloader and persistent root access on firmware version PS7717 or earlier.

Developed by XDA developer Pro-me3us, the project targets devices codenamed “gazelle”. It combines temporary privilege escalation with a separate bootloader vulnerability to enable lasting system modifications.

This release includes Magisk integration, TWRP recovery, unrestricted boot interfaces, and support for alternative operating systems.

However, the author warns that unlocking the bootloader can permanently brick the device, automatically erase all user data, and requires 1.5GB of user storage to maintain the unlocked configuration.

Amazon Fire TV Cube Security Flaws

The documented process begins with accessing Android Debug Bridge (ADB), which requires users to enable ADB debugging and connect from a supported computer or Android device.

The exploit package is then transferred to the Fire TV Cube and extracted. A temporary root executable is used to gain the elevated privileges necessary for the unlock script.

The project credits mforce2 for adapting the GhostLock exploit (CVE-2026-43499) and NebuSec for the original exploit chain.

The contributor notes that an earlier Fire TV port supported firmware versions from PS7664 to PS7716. At the same time, the latest package extends compatibility to PS7717/5741.

Temporary root and bootloader unlocking are separate stages. GhostLock provides privileged execution during the session, and the subsequent unlock process makes the necessary changes for persistent access.

After that, the Cube automatically enters TWRP to complete the installation, then returns to FireOS for device setup and account registration.

John Red is credited with discovering the bootloader vulnerability. The package acknowledges researcher Man Yue Mo’s Mali GPU exploitation work, involving CVE-2022-38181 and CVE-2022-46395, as foundational for information gathering and testing, rather than as the temporary root mechanism in this package.

Once unlocked, users gain Magisk-managed root access and TWRP functionality for firmware upgrades, downgrades, backups, and recovery. The package also removes Fastboot and Amlogic download mode restrictions, exposes U-Boot through an Ethernet netconsole, and enables USB booting.

These capabilities support multiboot configurations involving FireOS, CoreELEC, EmuELEC, and other operating systems on internal eMMC storage or USB media. Users can additionally modify system and vendor partitions, install custom launchers, restore local ADB functionality, and experiment with custom kernels or ROMs.

Version 1.2, released on September 30, 2026, adds support for PS7717/5741, updates Magisk to version 30.7, and includes a local ADB fix. It also clears the misc partition during unlocking to account for firmware updates downloaded before the procedure.

The author explicitly cautions against modifying the logo partition, as it maintains the unlock; altering it could lead to a hard-bricked device. Users are also advised not to re-run the bootloader unlock script. Executing the temporary root executable multiple times within one boot session may result in crashes and reboots.

The package disables Amazon’s OTA update component before reconnecting to the internet during setup. Although TWRP still allows firmware changes, the developer recommends keeping automatic updates blocked on unlocked devices.

For security reporting purposes, this demonstrated scenario is an ADB-assisted device modification workflow. It does not indicate an unauthenticated internet attack.

Support is limited to the third-generation Fire TV Cube and specified firmware versions; compatibility with newer releases or other Fire TV models has not been established.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.