Owners of Fire TV Cube 3 on PS7717 or older face bricking risks with new root unlock tool
A released package allows owners of the third-generation Fire TV Cube to unlock bootloaders and gain root access on firmware PS7717 or older, altering device security.
Key points
- XDA developer Pro-me3us released a package targeting "gazelle" devices with firmware PS7717 or older.
- The exploit combines temporary root via CVE-2026-43499 with a bootloader flaw for persistent access.
- The process requires ADB debugging, erases user data, and risks permanently bricking the device.
Business leaders should note that a public exploit package now allows users to gain persistent root access and unlock the bootloader on Amazon’s third-generation Fire TV Cube. According to Cyber Security News, the tool targets devices running firmware version PS7717 or older. This development shifts the device from a controlled streaming appliance to a modifiable platform, introducing operational risks for organizations that deploy these units in managed environments or shared spaces.
The risk
The exploit package, released by XDA developer Pro-me3us, targets devices internally known as “gazelle.” It leverages a combination of temporary privilege escalation and a separate bootloader vulnerability to enable lasting system modifications. According to GBHackers, the project integrates Magisk for root management and TWRP for recovery, allowing users to install alternative operating systems such as CoreELEC or EmuELEC. This bypasses Amazon’s intended security boundaries, potentially exposing network segments to unauthorized software or data exfiltration vectors if the devices are connected to corporate or small-business networks.
Who is exposed
Owners of the third-generation Fire TV Cube running firmware PS7717 or earlier are exposed to this exploit. Version 1.2 of the tool, dated September 30, 2026, extends compatibility to firmware PS7717/5741. The process requires users to enable Android Debug Bridge (ADB) debugging and authorize a connection from a computer or Android device. According to the XDA development thread, the exploit chain relies on mforce2’s port of the Ghostlock exploit, associated with CVE-2026-43499, and a bootloader vulnerability discovered by John Red.
Cost and compliance
The exploit package warns that the unlocking process can permanently damage the device, effectively bricking it. It also performs an automatic factory reset, erasing all user data, and requires 1.5GB of storage to maintain the unlocked state. According to Cyber Security News, the project credits NebuSec for the original exploit chain and Man Yue Mo for earlier Mali GPU work involving CVE-2022-38181 and CVE-2022-46395, which served as a basis for testing. These driver flaws highlight the broader risk of low-level bugs, though they are not the primary mechanism in this specific package.
What happens next
Once unlocked, the device gains unrestricted fastboot, Amlogic download mode, and U-Boot command line access over Ethernet. Users can boot from USB storage and modify system partitions. That suggests organizations using these devices in lobbies, meeting rooms, or guest areas must verify firmware versions immediately. Without a confirmed vendor patch, the risk of unauthorized modification remains high for any unit connected to a network where ADB debugging could be enabled.
What to do and how to stay safe: Amazon Fire TV Cube 3
- Audit all Amazon Fire TV Cube 3 devices to identify those running firmware PS7717 or older.
- Disable Android Debug Bridge (ADB) in developer settings on all deployed units to prevent local exploit execution.
- Isolate streaming devices on a separate network segment to limit lateral movement if a device is compromised.
- Monitor for unusual network traffic or boot behavior that may indicate unauthorized bootloader access or custom OS installation.
Step-by-step guide: Vulnerability Prioritization: Fix What Actually Breaks Your Business
General security guidance from the CloudSec Pulse newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which firmware versions are vulnerable to this exploit?
Devices running firmware version PS7717 or older are vulnerable, including the PS7717/5741 build targeted by version 1.2 of the tool.
Does this exploit require physical access to the device?
Yes, the process requires enabling ADB debugging and connecting via a computer or Android device to transfer and execute the exploit package.
Is there a patch available from Amazon?
No fix has been confirmed yet; the source material does not mention an official vendor update or mitigation for these vulnerabilities.
