When researchers at Synthient switched on a MECOOL KM9PRO Max they had acquired in late 2025, software supplied with the TV box contacted a server for instructions. The researchers found that the server could direct the box to install applications. A buyer who used it only to watch television had already given a remote operator a foothold simply by connecting the device.
On November 2, Google disclosed that it and its partners had disrupted the XCPE network, which it said had enrolled more than 1.3 million set-top boxes. Google assessed with high confidence that the manufacturer, Videostrong, had deliberately built and operated the backdoor. Google barred the company from producing certified Android devices and said it had changed how it reviews firmware.
The value of a box extended beyond the sale. An affiliate could route someone else’s internet traffic through the household connection or load software that generated fraudulent advertising activity. Google found that a component in the manufacturer’s partition could reinstall the backdoor at startup after a user removed the application. Taking down control servers interrupted the operators’ access while leaving that mechanism on the hardware.
NAOAT analysis
For a purchaser evaluating connected equipment, this case exposes a gap between the unit on the test bench and the unit in service. A device can pass a check on its preloaded applications and acquire different capabilities after it starts communicating. The most revealing part of Synthient’s examination was observing what the box requested after power-up and who could answer. That evidence links the software supplied at sale to the authority a third party retained afterward.