Public Exploit Grants Root Access and Bootloader Unlock on Amazon Fire TV Cube 3
A developer released a package enabling persistent root access on third-gen Fire TV Cube devices running firmware PS7717 or older, according to reports.
Key points
- The exploit targets Amazon Fire TV Cube 3 devices with firmware PS7717 or earlier.
- It combines temporary root access with a bootloader flaw to install Magisk and TWRP.
- The process performs a factory reset and requires 1.5GB of free storage space.
XDA developer Pro-me3us released a public exploit package that allows owners of the Amazon Fire TV Cube 3 to gain persistent root access and unlock the device bootloader. According to Cyber Security News, the tool targets firmware version PS7717 and older units, identified internally as "gazelle."
The project combines a temporary root access method with a separate bootloader vulnerability to enable deep system modifications. This combination allows users to bypass standard restrictions and install custom software components that Amazon does not officially support for these streaming devices.
Technical Components and Credits
The unlock process relies on several distinct security flaws and development efforts. Pro-me3us integrated components from other researchers to create the final package. The tool credits mforce2 for porting the Ghostlock exploit, which is associated with CVE-2026-43499. NebuSec is credited with developing the original exploit chain that facilitates these initial access vectors.
John Red is recognized for discovering the specific bootloader vulnerability that enables the permanent unlock. Additionally, the project acknowledges researcher Man Yue Mo’s earlier work on Mali GPU drivers, specifically CVE-2022-38181 and CVE-2022-46395. These GPU vulnerabilities served as a basis for testing and information gathering, though they are separate contributions from the main unlock mechanism.
Usage and Risks
Users initiate the process via Android Debug Bridge with debugging enabled and authorized connections on the Cube. A temporary root tool provides the necessary permissions for the unlock script to execute. The device then restarts into TWRP recovery to complete changes before returning to FireOS for setup.
The developer warns that this procedure can permanently damage the hardware. It automatically performs a factory reset and requires 1.5GB of user storage to maintain the unlock state. Once completed, devices gain Magisk support, TWRP backup features, unrestricted fastboot, and Amlogic download mode access.
Affected Versions and Capabilities
Version 1.2 of the exploit, released on September 30, 2026, extends the temporary root tool to firmware PS7717/5741. This update also includes Magisk version 30.7 and a local ADB fix. Owners can access the U-Boot command line over Ethernet and boot from USB storage devices using these modifications.
These changes allow the installation of custom launchers, modified system partitions, and alternative operating systems. Related projects include CoreELEC for Kodi-based media playback and EmuELEC for retro gaming. These features transform the streaming device into a flexible platform for personal testing and use.
What should you do?
No official patch from Amazon has been confirmed yet to address this specific combination of exploits. Users should verify their current firmware version to determine if they are running PS7717 or older. Those who have not authorized ADB connections remain protected until they enable debugging features.
What to do and how to stay safe: Amazon Fire TV Cube
- Check your device settings to ensure Android Debug Bridge and USB debugging are disabled.
- Review your installed firmware version to see if it predates the latest security updates.
- Avoid connecting your streaming device to untrusted networks while ADB is enabled.
- Monitor official vendor channels for confirmation of a patch addressing bootloader vulnerabilities.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Amazon devices are affected by this exploit?
The exploit affects the third-generation Amazon Fire TV Cube, specifically units running firmware PS7717 or older.
What is the risk of using this exploit?
The developer warns that the process can permanently damage the device and performs an automatic factory reset.
Are there any CVEs associated with this unlock method?
Yes, the project cites CVE-2026-43499 for the Ghostlock exploit and references CVE-2022-38181 and CVE-2022-46395 for earlier GPU work.
