CVE-2026-36027: Code27 Companion Hub USB Debugging Arbitrary Code Execution

Technical summary

This vulnerability stems from insufficient access controls in the USB debugging interface of Code27 Companion Hub SQ3A.220705.003.A1. The Android Debug Bridge (ADB) component fails to properly validate or restrict code execution requests over USB connections, classified under CWE-1313 (Improper Control of Dynamically-Managed Code Resources). An attacker with direct physical access can connect via USB and execute arbitrary commands with high privileges on the affected device, achieving code execution without requiring authentication, user interaction, or elevated initial privileges.

Business impact

Organizations deploying Code27 Companion Hub devices in environments where physical security cannot be guaranteed face risk of device compromise. An attacker gaining code execution can exfiltrate sensitive data, modify device configurations, install persistent backdoors, or use the compromised device as a pivot point into corporate networks. The impact is heightened in mobile device management (MDM) scenarios, field operations, or shared facility deployments where devices may be left unattended or accessible to untrusted individuals.

Affected systems

Code27 Companion Hub build SQ3A.220705.003.A1 is the confirmed affected version. This vulnerability specifically targets the USB debugging and Android Debug Bridge components. Organizations should verify whether they are running this exact build version and whether ADB is enabled on deployed instances. Patched or newer versions should be identified from Code27's official security advisories.

Exploitability

Exploitation requires physical proximity to the device and a USB connection; however, once connected, no authentication, user consent, or additional interaction is needed to trigger code execution. This makes the attack vector straightforward for an attacker with hands-on access. The CVSS score of 6.8 reflects the physical access barrier (reducing likelihood in many scenarios) balanced against high confidentiality, integrity, and availability impact once access is obtained.

Remediation

Immediately identify all instances of Code27 Companion Hub SQ3A.220705.003.A1 in your environment. Consult Code27's security advisory for patched build versions and apply updates as soon as possible. As an interim measure, disable USB debugging on all deployed devices and implement physical security controls to restrict unauthorized USB connections. Consider deploying mobile device management (MDM) policies to enforce ADB restrictions and monitor for suspicious USB connection events.

Patch guidance

Check Code27's official security advisory portal for patched builds released after SQ3A.220705.003.A1. Apply patches during a controlled maintenance window, beginning with test environments. Verify that patched builds maintain compatibility with your existing deployments. Document patch application dates and build versions for compliance tracking. Ensure devices are fully updated before returning them to production use.

Detection guidance

Monitor for unexpected USB connections to devices running Code27 Companion Hub, particularly from unfamiliar hosts or during non-business hours. Review ADB logs for unauthorized connection attempts or code execution traces. Implement device-level logging to capture USB debugging activities. Check for unauthorized modifications to device configurations or system files that may indicate post-compromise activity. Security Information and Event Management (SIEM) systems should flag any unexpected shell access or elevated privilege execution on these devices.

Why prioritize this

Although marked as medium severity, this vulnerability warrants prompt attention because: (1) exploitation is trivial once physical access is obtained—no user interaction or authentication is required; (2) code execution is unrestricted, enabling full device compromise; (3) the impact is high across confidentiality, integrity, and availability; (4) the vulnerability affects specialized mobile devices that may handle sensitive operations or corporate data. Physical security controls provide some practical protection but are not reliable in all environments. Patch deployment should be expedited.

Risk score, explained

The CVSS 3.1 score of 6.8 (MEDIUM) is calculated with Attack Vector: Physical (AV:P), Attack Complexity: Low (AC:L), Privileges Required: None (PR:N), User Interaction: None (UI:N), Scope: Unchanged (S:U), and high impact across Confidentiality, Integrity, and Availability. The physical access requirement reduces the likelihood relative to network attacks but does not eliminate risk, especially in mobile or field deployment scenarios. Organizations unable to guarantee physical device security should treat this as functionally higher-impact than the numeric score suggests.

Frequently asked questions