CVE-2026-49004PostgreSQL Misconfiguration and Command Injection Vulnerability in ZTE NX799J (Red Magic 11 Air) Product
Updated under an hour ago ()
Does this affect you?
It affects ZTE NX799J (Red Magic 11 Air). Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
The built-in PostgreSQL service on the mobile device suffers from misconfiguration flaws and command injection vulnerabilities. This service listens on a specific port, runs with root privileges, and is protected by weak credentials. The database supports the COPY FROM PROGRAM syntax, allowing local attackers to bypass Android's permission sandbox and gain full root access.
- CVSS
- 6.5 MEDIUM (v3.1, CNA)CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
- Weakness (CWE)
- CWE-89
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- zte
- NVD analysis
- Deferred
- Record last updated
- Aug 7, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
ZTE NX799J (Red Magic 11 Air) zte:nx799j_red_magic_11_air (from the name) | GEN_CN_NX799JV1.0.0B15 | CNA record |
References
- https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/460174866982027405
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.